9769af594b5b720cbff7c6804c663159ba8768492b39500f3aa2c9e49ba65b80

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 07:13

Target

9769af594b5b720cbff7c6804c663159ba8768492b39500f3aa2c9e49ba65b80.exe
Size

6KB
MD5

d0db6bbe439acc21f21d08571aa621bd
SHA1

edf114dfe0f72974bb3e6cb9f6ca02babf10977a
SHA256

9769af594b5b720cbff7c6804c663159ba8768492b39500f3aa2c9e49ba65b80
SHA512

75047032d2303ff3ef1d94db5246be762fde305ed6ad4b59fb27d7489ab72fa399b06337525f5eb4c1273f89b6705ccfb95e7d0011dab0ae38bc268f0004ddc7
SSDEEP

48:S8bt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9usO:p0mIGnFc/38+N4ZHJWSY9FI5WqNx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2856	1724	9769af594b5b720cbff7c6804c663159ba8768492b39500f3aa2c9e49ba65b80.exe	28
PID 1724 wrote to memory of 2856	1724	9769af594b5b720cbff7c6804c663159ba8768492b39500f3aa2c9e49ba65b80.exe	28
PID 1724 wrote to memory of 2856	1724	9769af594b5b720cbff7c6804c663159ba8768492b39500f3aa2c9e49ba65b80.exe	28

C:\Users\Admin\AppData\Local\Temp\9769af594b5b720cbff7c6804c663159ba8768492b39500f3aa2c9e49ba65b80.exe
"C:\Users\Admin\AppData\Local\Temp\9769af594b5b720cbff7c6804c663159ba8768492b39500f3aa2c9e49ba65b80.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1724 -s 32
  2⤵
  PID:2856