f35461f76794c7bb2c96c883a644d31b506d8d35a73cf9e0193dea8adced3159

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
11-11-2023 03:48

Target

f35461f76794c7bb2c96c883a644d31b506d8d35a73cf9e0193dea8adced3159.exe
Size

1.6MB
MD5

e37d2f0bef19c9eb2f0d599bd5355ddb
SHA1

702973fa3c639f100268cab5a4ef0faf2a6b8341
SHA256

f35461f76794c7bb2c96c883a644d31b506d8d35a73cf9e0193dea8adced3159
SHA512

79ea277e5070d8aee36d8d00d0a928dcbaab3584cbba5396cbb8f78fbccb71421a3a714b2af02ad30ccd3044aa9cbde728e1bbe40a048a42247ead05d56a4449
SSDEEP

24576:rjzLT3RNm/MROmd89xCgK9n6ImBSwhWjzklFS4BaLs3kjgoVr7m/DSVXT5XjPfya:rjXV6BbWjzKFS4w/xPhXT5XjPf1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2136	2924	f35461f76794c7bb2c96c883a644d31b506d8d35a73cf9e0193dea8adced3159.exe	28
PID 2924 wrote to memory of 2136	2924	f35461f76794c7bb2c96c883a644d31b506d8d35a73cf9e0193dea8adced3159.exe	28
PID 2924 wrote to memory of 2136	2924	f35461f76794c7bb2c96c883a644d31b506d8d35a73cf9e0193dea8adced3159.exe	28

C:\Users\Admin\AppData\Local\Temp\f35461f76794c7bb2c96c883a644d31b506d8d35a73cf9e0193dea8adced3159.exe
"C:\Users\Admin\AppData\Local\Temp\f35461f76794c7bb2c96c883a644d31b506d8d35a73cf9e0193dea8adced3159.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2924 -s 144
  2⤵
  PID:2136