ecb3307bcb139077d4e9aafbf7fa262acbfee30ac87c466de5be51ba944359df

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01-11-2023 11:31

Target

ecb3307bcb139077d4e9aafbf7fa262acbfee30ac87c466de5be51ba944359df.exe
Size

1.7MB
MD5

291e6ad289006fbdfd64d7c1d594b376
SHA1

044e00c11efd9022052e5b429bbd6abb1897e483
SHA256

ecb3307bcb139077d4e9aafbf7fa262acbfee30ac87c466de5be51ba944359df
SHA512

361b29482b30eeea1f78f796196b02770c8e7517b22a0d4ed49581785bcff8ffabf9244369ad1813f0535a31892d6fd64852d095d1689beff76be11dbaa649ec
SSDEEP

49152:sU0W9+rQgGtHXOQz+XI9kx4eEyhInBXT5Xr1:Xaqh+XT4eJhInBD5b1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 1636	2800	ecb3307bcb139077d4e9aafbf7fa262acbfee30ac87c466de5be51ba944359df.exe	28
PID 2800 wrote to memory of 1636	2800	ecb3307bcb139077d4e9aafbf7fa262acbfee30ac87c466de5be51ba944359df.exe	28
PID 2800 wrote to memory of 1636	2800	ecb3307bcb139077d4e9aafbf7fa262acbfee30ac87c466de5be51ba944359df.exe	28

C:\Users\Admin\AppData\Local\Temp\ecb3307bcb139077d4e9aafbf7fa262acbfee30ac87c466de5be51ba944359df.exe
"C:\Users\Admin\AppData\Local\Temp\ecb3307bcb139077d4e9aafbf7fa262acbfee30ac87c466de5be51ba944359df.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2800 -s 144
  2⤵
  PID:1636