c7138549f146d7165b459ecc827d0b44930ee92993b801c8228a0f27b4aac3a4

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
20/11/2023, 03:00

Target

c7138549f146d7165b459ecc827d0b44930ee92993b801c8228a0f27b4aac3a4.exe
Size

780KB
MD5

01def325854ea8639dc29e856177650e
SHA1

230bbd502afa154be14f5a77597755fd2b892916
SHA256

c7138549f146d7165b459ecc827d0b44930ee92993b801c8228a0f27b4aac3a4
SHA512

5552d6078633dbcdd1f011a22f723222e9abeac1d345f4bd250fce7a817edc3d5b9e5de0e1eb8cb5baf11e45b4ca81e4aaa486a9b61e927d21246bc1aa980acf
SSDEEP

12288:oNJnrevKz2l/IwV456W0MleWPlIE2Hen6Zh7kK3ITYr8Ti75w:oNJnB5SGHIE2Hen6rkKQ66

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2216	2508	c7138549f146d7165b459ecc827d0b44930ee92993b801c8228a0f27b4aac3a4.exe	29
PID 2508 wrote to memory of 2216	2508	c7138549f146d7165b459ecc827d0b44930ee92993b801c8228a0f27b4aac3a4.exe	29
PID 2508 wrote to memory of 2216	2508	c7138549f146d7165b459ecc827d0b44930ee92993b801c8228a0f27b4aac3a4.exe	29

C:\Users\Admin\AppData\Local\Temp\c7138549f146d7165b459ecc827d0b44930ee92993b801c8228a0f27b4aac3a4.exe
"C:\Users\Admin\AppData\Local\Temp\c7138549f146d7165b459ecc827d0b44930ee92993b801c8228a0f27b4aac3a4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2508 -s 20
  2⤵
  PID:2216

memory/2508-0-0x00000000002F0000-0x00000000003CC000-memory.dmp

Filesize
880KB

Download