14d376dfa0f24a09634603c5edd08737974924c59e762fb9d1eb31da7079449a

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01-12-2023 07:57

Target

14d376dfa0f24a09634603c5edd08737974924c59e762fb9d1eb31da7079449a.exe
Size

378KB
MD5

d04eaf025dfec65b50d1ce1960e00583
SHA1

f042cea0283ecb5e487cb69e5790edec221e9c50
SHA256

14d376dfa0f24a09634603c5edd08737974924c59e762fb9d1eb31da7079449a
SHA512

951fbe9210ee7e9564149e16df00d42f9742b671e3d2624b749faca7fbe0f354178b81bd5827ef3ca802dce3dedd7f541949bb1927f7d01dd57624eb0923f46f
SSDEEP

6144:hdUEUGjKMw8rzAf7KWu1EcTUQROENqP5m3nCWkV7kfL/uJMdzY2BiT2wnfq:hdkMwtlcTUQquXkV7kfLmGdzYr2wnfq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

14d376dfa0f24a09634603c5edd08737974924c59e762fb9d1eb31da7079449a.exe

description	pid	process	target process
PID 2040 wrote to memory of 2820	2040	14d376dfa0f24a09634603c5edd08737974924c59e762fb9d1eb31da7079449a.exe	WerFault.exe
PID 2040 wrote to memory of 2820	2040	14d376dfa0f24a09634603c5edd08737974924c59e762fb9d1eb31da7079449a.exe	WerFault.exe
PID 2040 wrote to memory of 2820	2040	14d376dfa0f24a09634603c5edd08737974924c59e762fb9d1eb31da7079449a.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\14d376dfa0f24a09634603c5edd08737974924c59e762fb9d1eb31da7079449a.exe
"C:\Users\Admin\AppData\Local\Temp\14d376dfa0f24a09634603c5edd08737974924c59e762fb9d1eb31da7079449a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2040 -s 32
  2⤵
  PID:2820