0bf8c9137370c762cddc5c5b545708992dd567a60df00ed09e3e63c801b2eec5

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 16:44

Target

0bf8c9137370c762cddc5c5b545708992dd567a60df00ed09e3e63c801b2eec5.exe
Size

6KB
MD5

2c17ae3fae123d5b384873549002839a
SHA1

550aea87b718958ae30109ff1ba21d98602c1f69
SHA256

0bf8c9137370c762cddc5c5b545708992dd567a60df00ed09e3e63c801b2eec5
SHA512

847d6713782e753fa6e350a6e4be7810facdb3b4295ee9b68d278ed6b2da13736c3d6d628c52b89caf7340ae35a1755dae83533f66727c09f33db70b39c68af6
SSDEEP

48:SFbt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9uIO:I0mIGnFc/38+N4ZHJWSY9FI5WqBx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2860	2972	0bf8c9137370c762cddc5c5b545708992dd567a60df00ed09e3e63c801b2eec5.exe	28
PID 2972 wrote to memory of 2860	2972	0bf8c9137370c762cddc5c5b545708992dd567a60df00ed09e3e63c801b2eec5.exe	28
PID 2972 wrote to memory of 2860	2972	0bf8c9137370c762cddc5c5b545708992dd567a60df00ed09e3e63c801b2eec5.exe	28

C:\Users\Admin\AppData\Local\Temp\0bf8c9137370c762cddc5c5b545708992dd567a60df00ed09e3e63c801b2eec5.exe
"C:\Users\Admin\AppData\Local\Temp\0bf8c9137370c762cddc5c5b545708992dd567a60df00ed09e3e63c801b2eec5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2972 -s 32
  2⤵
  PID:2860