f65c62e5a2bbf0c4d437ea0494c33e50d16ecab95d8b6655b1053dbd5d03e76c

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
05/11/2023, 12:52

Target

f65c62e5a2bbf0c4d437ea0494c33e50d16ecab95d8b6655b1053dbd5d03e76c.exe
Size

400KB
MD5

f0de950cca2b38102f771b2d946e04bf
SHA1

d43dbf167920b08ce39743ded126db346f103e13
SHA256

f65c62e5a2bbf0c4d437ea0494c33e50d16ecab95d8b6655b1053dbd5d03e76c
SHA512

48f1763daaca9c38acc562011a64f2b8e969675ddba51c06826823c3f7c8cc6f9a94815407fc5d81c91fadc4b36761151d83126f865847a8a77840b9a6174a3f
SSDEEP

6144:sP+nER2sX6zWf0G+TP/XXVeXC8X3cO9bOXX3H1:s+GOz1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2836	2224	f65c62e5a2bbf0c4d437ea0494c33e50d16ecab95d8b6655b1053dbd5d03e76c.exe	29
PID 2224 wrote to memory of 2836	2224	f65c62e5a2bbf0c4d437ea0494c33e50d16ecab95d8b6655b1053dbd5d03e76c.exe	29
PID 2224 wrote to memory of 2836	2224	f65c62e5a2bbf0c4d437ea0494c33e50d16ecab95d8b6655b1053dbd5d03e76c.exe	29

C:\Users\Admin\AppData\Local\Temp\f65c62e5a2bbf0c4d437ea0494c33e50d16ecab95d8b6655b1053dbd5d03e76c.exe
"C:\Users\Admin\AppData\Local\Temp\f65c62e5a2bbf0c4d437ea0494c33e50d16ecab95d8b6655b1053dbd5d03e76c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2224 -s 516
  2⤵
  PID:2836

memory/2224-0-0x00000000013C0000-0x0000000001428000-memory.dmp

Filesize
416KB

Download
memory/2224-1-0x000007FEF54E0000-0x000007FEF5ECC000-memory.dmp

Filesize
9.9MB

Download
memory/2224-2-0x000000001AE30000-0x000000001AEB0000-memory.dmp

Filesize
512KB

Download
memory/2224-3-0x000007FEF54E0000-0x000007FEF5ECC000-memory.dmp

Filesize
9.9MB

Download
memory/2224-4-0x000000001AE30000-0x000000001AEB0000-memory.dmp

Filesize
512KB

Download