62ab26d09334c2e0b5eac9e715f19a45735df5de1a19eeb2b2f88cf45ae69cd0

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
31/10/2023, 14:03

Target

6757ffba17fc6615ebb9ba02871a7f5a802408caf96fab7bf0647a1ae351f2a8.exe
Size

7.5MB
MD5

62ef21753edeacc68cfadd1b756365fd
SHA1

8ae9bfe71fa3bff0d491ac81503c4a4a5ecdf970
SHA256

6757ffba17fc6615ebb9ba02871a7f5a802408caf96fab7bf0647a1ae351f2a8
SHA512

845194aece3c202cc127911b641606d7fb91a6e45c825161656fb12cfac17d82be2f2b6e91ade29cd4132900862205a9631a2771e9c190d83ecd802c7096d892
SSDEEP

196608:F39WWWWWWWWWWWZwONT2nlQ2FbUaNKiOfGvfNWWW:FLyQQoVafGvf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1280	2028	6757ffba17fc6615ebb9ba02871a7f5a802408caf96fab7bf0647a1ae351f2a8.exe	27
PID 2028 wrote to memory of 1280	2028	6757ffba17fc6615ebb9ba02871a7f5a802408caf96fab7bf0647a1ae351f2a8.exe	27
PID 2028 wrote to memory of 1280	2028	6757ffba17fc6615ebb9ba02871a7f5a802408caf96fab7bf0647a1ae351f2a8.exe	27

C:\Users\Admin\AppData\Local\Temp\6757ffba17fc6615ebb9ba02871a7f5a802408caf96fab7bf0647a1ae351f2a8.exe
"C:\Users\Admin\AppData\Local\Temp\6757ffba17fc6615ebb9ba02871a7f5a802408caf96fab7bf0647a1ae351f2a8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2028 -s 536
  2⤵
  PID:1280

memory/2028-0-0x0000000000BF0000-0x000000000137C000-memory.dmp

Filesize
7.5MB

Download
memory/2028-1-0x000007FEF5260000-0x000007FEF5C4C000-memory.dmp

Filesize
9.9MB

Download
memory/2028-2-0x000007FEF5260000-0x000007FEF5C4C000-memory.dmp

Filesize
9.9MB

Download