6e042391d4f10347b6f7ad6fe79a0372b031ebbb397bec7f55273bbdd88df10d

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
03-11-2023 07:40

Target

6e042391d4f10347b6f7ad6fe79a0372b031ebbb397bec7f55273bbdd88df10d.exe
Size

6KB
MD5

eb75faa30c5c91bdcabe3c6ff00b6b41
SHA1

987835b9d45508cfbe5a218ed2552f5bfe260d1a
SHA256

6e042391d4f10347b6f7ad6fe79a0372b031ebbb397bec7f55273bbdd88df10d
SHA512

0e4d84ce760f24a101bfcaaa1ae7cacc4dbcf5541e551786844a1bc16c24105d5e00d90c7eec421f951c969b7cc863cd171d8420e0cf49851c59fabd1fbd639b
SSDEEP

48:SUbt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9uwO:10mIGnFc/38+N4ZHJWSY9FI5Wqpx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 1056	796	6e042391d4f10347b6f7ad6fe79a0372b031ebbb397bec7f55273bbdd88df10d.exe	28
PID 796 wrote to memory of 1056	796	6e042391d4f10347b6f7ad6fe79a0372b031ebbb397bec7f55273bbdd88df10d.exe	28
PID 796 wrote to memory of 1056	796	6e042391d4f10347b6f7ad6fe79a0372b031ebbb397bec7f55273bbdd88df10d.exe	28

C:\Users\Admin\AppData\Local\Temp\6e042391d4f10347b6f7ad6fe79a0372b031ebbb397bec7f55273bbdd88df10d.exe
"C:\Users\Admin\AppData\Local\Temp\6e042391d4f10347b6f7ad6fe79a0372b031ebbb397bec7f55273bbdd88df10d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 796 -s 32
  2⤵
  PID:1056