f35461f76794c7bb2c96c883a644d31b506d8d35a73cf9e0193dea8adced3159

Analysis

max time kernel
193s
max time network
214s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2023, 03:48

Target
f35461f76794c7bb2c96c883a644d31b506d8d35a73cf9e0193dea8adced3159.exe
Size 1.6MB
Sample231111-edasfaad36
SHA256 f35461f76794c7bb2c96c883a644d31b506d8d35a73cf9e0193dea8adced3159
MD5 e37d2f0bef19c9eb2f0d599bd5355ddb
SHA1 702973fa3c639f100268cab5a4ef0faf2a6b8341
SHA512 79ea277e5070d8aee36d8d00d0a928dcbaab3584cbba5396cbb8f78fbccb71421a3a714b2af02ad30ccd3044aa9cbde728e1bbe40a048a42247ead05d56a4449
SSDEEP 24576:rjzLT3RNm/MROmd89xCgK9n6ImBSwhWjzklFS4BaLs3kjgoVr7m/DSVXT5XjPfya:rjXV6BbWjzKFS4w/xPhXT5XjPf1
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 732	3216	f35461f76794c7bb2c96c883a644d31b506d8d35a73cf9e0193dea8adced3159.exe	91
PID 3216 wrote to memory of 732	3216	f35461f76794c7bb2c96c883a644d31b506d8d35a73cf9e0193dea8adced3159.exe	91

C:\Users\Admin\AppData\Local\Temp\f35461f76794c7bb2c96c883a644d31b506d8d35a73cf9e0193dea8adced3159.exe
"C:\Users\Admin\AppData\Local\Temp\f35461f76794c7bb2c96c883a644d31b506d8d35a73cf9e0193dea8adced3159.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3216 -s 392
  2⤵
  PID:732