032f9ce99a31ef38c6a88f48139119b97fadc302af58735cc8179c3703862c8f

Analysis

max time kernel
202s
max time network
212s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 18:25

Target

032f9ce99a31ef38c6a88f48139119b97fadc302af58735cc8179c3703862c8f.exe
Size

1.6MB
MD5

cbbe5fcc071ee0ae3be5e394594c0183
SHA1

27d34a2d90c91c6d3cebe76c41359a1ba11c5060
SHA256

032f9ce99a31ef38c6a88f48139119b97fadc302af58735cc8179c3703862c8f
SHA512

53a97bbbaddc6fdc6ab6c8bba69c69411b70022111e298060f7d26ab535ed8b0c19c020f0f4866ab1c683cce80503853128b1202b88d09d7ed9d1db585153aa5
SSDEEP

24576:RkU4gtStDi1ZIw8mUZRUM3Kb8CftEIytStPK0eDSVXT5XvWyFya:R74g6Di16wJURLKb804/0zXT5XvF1

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 4900	1780	032f9ce99a31ef38c6a88f48139119b97fadc302af58735cc8179c3703862c8f.exe	86
PID 1780 wrote to memory of 4900	1780	032f9ce99a31ef38c6a88f48139119b97fadc302af58735cc8179c3703862c8f.exe	86

C:\Users\Admin\AppData\Local\Temp\032f9ce99a31ef38c6a88f48139119b97fadc302af58735cc8179c3703862c8f.exe
"C:\Users\Admin\AppData\Local\Temp\032f9ce99a31ef38c6a88f48139119b97fadc302af58735cc8179c3703862c8f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1780 -s 392
  2⤵
  PID:4900