2ddea0bfc8e5f9ceaf524a1ea2716d12a430c2b0c64e5d6f8c411da5fa6bffe1

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 11:09

Target

2ddea0bfc8e5f9ceaf524a1ea2716d12a430c2b0c64e5d6f8c411da5fa6bffe1.exe
Size

99KB
MD5

c1672b14f95384b2cd3178176f70016d
SHA1

e32ce649a89d7e23de6ae1bff01b72198725374d
SHA256

2ddea0bfc8e5f9ceaf524a1ea2716d12a430c2b0c64e5d6f8c411da5fa6bffe1
SHA512

a75bd3c9f280addae8c68aeaa66207fecd995362c0466c87561945b41ae245fe89e502d39b81e063fe6ec3d0094d937c96caee81e00aaf350d903e905cd7ab37
SSDEEP

1536:czHE1olR7eLMOd2uY6rxqXtIpbbeb1sZbeoL338b8DDJf7R9whjok3xowSTa1LD8:b1olR7eLMv5xaZbesDD6oGPfYPuJA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2240	2372	2ddea0bfc8e5f9ceaf524a1ea2716d12a430c2b0c64e5d6f8c411da5fa6bffe1.exe	29
PID 2372 wrote to memory of 2240	2372	2ddea0bfc8e5f9ceaf524a1ea2716d12a430c2b0c64e5d6f8c411da5fa6bffe1.exe	29
PID 2372 wrote to memory of 2240	2372	2ddea0bfc8e5f9ceaf524a1ea2716d12a430c2b0c64e5d6f8c411da5fa6bffe1.exe	29

C:\Users\Admin\AppData\Local\Temp\2ddea0bfc8e5f9ceaf524a1ea2716d12a430c2b0c64e5d6f8c411da5fa6bffe1.exe
"C:\Users\Admin\AppData\Local\Temp\2ddea0bfc8e5f9ceaf524a1ea2716d12a430c2b0c64e5d6f8c411da5fa6bffe1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2372 -s 36
  2⤵
  PID:2240

memory/2372-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download