f35461f76794c7bb2c96c883a644d31b506d8d35a73cf9e0193dea8adced3159

Analysis

max time kernel
193s
max time network
214s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2023 03:48

Target

f35461f76794c7bb2c96c883a644d31b506d8d35a73cf9e0193dea8adced3159.exe
Size

1.6MB
MD5

e37d2f0bef19c9eb2f0d599bd5355ddb
SHA1

702973fa3c639f100268cab5a4ef0faf2a6b8341
SHA256

f35461f76794c7bb2c96c883a644d31b506d8d35a73cf9e0193dea8adced3159
SHA512

79ea277e5070d8aee36d8d00d0a928dcbaab3584cbba5396cbb8f78fbccb71421a3a714b2af02ad30ccd3044aa9cbde728e1bbe40a048a42247ead05d56a4449
SSDEEP

24576:rjzLT3RNm/MROmd89xCgK9n6ImBSwhWjzklFS4BaLs3kjgoVr7m/DSVXT5XjPfya:rjXV6BbWjzKFS4w/xPhXT5XjPf1

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 732	3216	f35461f76794c7bb2c96c883a644d31b506d8d35a73cf9e0193dea8adced3159.exe	91
PID 3216 wrote to memory of 732	3216	f35461f76794c7bb2c96c883a644d31b506d8d35a73cf9e0193dea8adced3159.exe	91

C:\Users\Admin\AppData\Local\Temp\f35461f76794c7bb2c96c883a644d31b506d8d35a73cf9e0193dea8adced3159.exe
"C:\Users\Admin\AppData\Local\Temp\f35461f76794c7bb2c96c883a644d31b506d8d35a73cf9e0193dea8adced3159.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3216 -s 392
  2⤵
  PID:732