bd1d6a02a8b84b4a6ec252f592cda09d7dd31760ec7e5d6db267d0f961f937af

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10-10-2023 06:28

Target

bd1d6a02a8b84b4a6ec252f592cda09d7dd31760ec7e5d6db267d0f961f937af.exe
Size

38KB
MD5

c961feda259bc2c73a07c7b549658f74
SHA1

0800b4f0b105e96b5c72c50048ad4fe6e80254f8
SHA256

bd1d6a02a8b84b4a6ec252f592cda09d7dd31760ec7e5d6db267d0f961f937af
SHA512

c46b8d6e4abd5df15f64cc5f4caa936f8335372981909bb8bd543621704a3380e16f05fce251107cbfadc5b62907fc019212000fcdeff2e2e8f95baa6f928d4f
SSDEEP

768:E8Cpm91BJWaopCM41v1TbpCxvCAEZDY4m/YL:E8Cpyx1HMTEmvi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2024	2900	bd1d6a02a8b84b4a6ec252f592cda09d7dd31760ec7e5d6db267d0f961f937af.exe	29
PID 2900 wrote to memory of 2024	2900	bd1d6a02a8b84b4a6ec252f592cda09d7dd31760ec7e5d6db267d0f961f937af.exe	29
PID 2900 wrote to memory of 2024	2900	bd1d6a02a8b84b4a6ec252f592cda09d7dd31760ec7e5d6db267d0f961f937af.exe	29

C:\Users\Admin\AppData\Local\Temp\bd1d6a02a8b84b4a6ec252f592cda09d7dd31760ec7e5d6db267d0f961f937af.exe
"C:\Users\Admin\AppData\Local\Temp\bd1d6a02a8b84b4a6ec252f592cda09d7dd31760ec7e5d6db267d0f961f937af.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2900 -s 536
  2⤵
  PID:2024

memory/2900-0-0x0000000001220000-0x0000000001230000-memory.dmp

Filesize
64KB

Download
memory/2900-1-0x000007FEF60C0000-0x000007FEF6AAC000-memory.dmp

Filesize
9.9MB

Download
memory/2900-2-0x000007FEF60C0000-0x000007FEF6AAC000-memory.dmp

Filesize
9.9MB

Download