3602798494064acab8816015b8b404bcc5eac483c3480bc3e6e4e00183b39229

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 09:48

Target

3602798494064acab8816015b8b404bcc5eac483c3480bc3e6e4e00183b39229.exe
Size

11.8MB
MD5

026e89505754751c9ec5a837bfd2680b
SHA1

a014337c0d15edaf1034878f87ac00e837665415
SHA256

3602798494064acab8816015b8b404bcc5eac483c3480bc3e6e4e00183b39229
SHA512

7b26eb900f00c66f47cee4cbb840c34e93dac810a065f07f3f5bf8c22f3181a643ad37ed7ba7a712eeb2f1ba852417d77781d8021a35d11150a9af36e09f3ef1
SSDEEP

49152:9Ord9DoyLqJfREK6nTLCsKe/Q8iH/uFzv/bpQYu/ssba:YrdpPafW/IiKisba

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2604	1704	3602798494064acab8816015b8b404bcc5eac483c3480bc3e6e4e00183b39229.exe	28
PID 1704 wrote to memory of 2604	1704	3602798494064acab8816015b8b404bcc5eac483c3480bc3e6e4e00183b39229.exe	28
PID 1704 wrote to memory of 2604	1704	3602798494064acab8816015b8b404bcc5eac483c3480bc3e6e4e00183b39229.exe	28

C:\Users\Admin\AppData\Local\Temp\3602798494064acab8816015b8b404bcc5eac483c3480bc3e6e4e00183b39229.exe
"C:\Users\Admin\AppData\Local\Temp\3602798494064acab8816015b8b404bcc5eac483c3480bc3e6e4e00183b39229.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1704 -s 544
  2⤵
  PID:2604

memory/1704-1-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

Filesize
9.9MB

Download
memory/1704-0-0x000000013F820000-0x00000001403F6000-memory.dmp

Filesize
11.8MB

Download
memory/1704-2-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

Filesize
9.9MB

Download