2e560d80f9560b9f6507a79cc383c60c11821b877ce1ed716a2b3a8ecc38ceaa

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 07:18

Target

2e560d80f9560b9f6507a79cc383c60c11821b877ce1ed716a2b3a8ecc38ceaa.exe
Size

326KB
MD5

95d67a6a867876abaa183a9c6bfcd327
SHA1

295c14bdeb11ededbbc29a82cda6b8927e2715d2
SHA256

2e560d80f9560b9f6507a79cc383c60c11821b877ce1ed716a2b3a8ecc38ceaa
SHA512

d3afcbd5f0ef12bd548a2b7f80720594f898352dda4d7fd56a9ad7c23b61694b14b0d6024b4d48f7e2e1226a267876821a8d90bfcdf518f5197413a4971cfe80
SSDEEP

6144:9fza7ALRvWwGOiAPyS7BhaC07UajuddWipmoiaiF2Qva8aTn4Kd8:9f+B9R6V7Xt0nKK7/PFRvXCd8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2084	1900	2e560d80f9560b9f6507a79cc383c60c11821b877ce1ed716a2b3a8ecc38ceaa.exe	29
PID 1900 wrote to memory of 2084	1900	2e560d80f9560b9f6507a79cc383c60c11821b877ce1ed716a2b3a8ecc38ceaa.exe	29
PID 1900 wrote to memory of 2084	1900	2e560d80f9560b9f6507a79cc383c60c11821b877ce1ed716a2b3a8ecc38ceaa.exe	29

C:\Users\Admin\AppData\Local\Temp\2e560d80f9560b9f6507a79cc383c60c11821b877ce1ed716a2b3a8ecc38ceaa.exe
"C:\Users\Admin\AppData\Local\Temp\2e560d80f9560b9f6507a79cc383c60c11821b877ce1ed716a2b3a8ecc38ceaa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1900 -s 36
  2⤵
  PID:2084

memory/1900-0-0x00000000006E0000-0x0000000000760000-memory.dmp

Filesize
512KB

Download
memory/1900-1-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1900-2-0x00000000006E0000-0x0000000000760000-memory.dmp

Filesize
512KB

Download