4c599cf148672a5d55eda9f1b34b3812e7e56f321b05ea969e83cd8c3add9813

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/12/2023, 12:09

Target

1b983c1ad539fc534debcece0e1bef91.exe
Size

8KB
MD5

1b983c1ad539fc534debcece0e1bef91
SHA1

7103076668307c13294ff47fb82326c56263df9a
SHA256

4c599cf148672a5d55eda9f1b34b3812e7e56f321b05ea969e83cd8c3add9813
SHA512

6e8b5260cda2762127973190421313d39032a4320117132724012565597babd35cc9684d0b851ca4b5bbb90ff1d556862640966ed97de77440b7ff60e0dfd7b6
SSDEEP

96:wPqSioDPSVdCiIwJdHG/uGlrElkHagmycE2VYlnlYJnL6L0KffCNcsAO0uVRXmmT:4qRoGLdm/uyvHO3VInlYJL6LTb52Yc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 1032	952	1b983c1ad539fc534debcece0e1bef91.exe	28
PID 952 wrote to memory of 1032	952	1b983c1ad539fc534debcece0e1bef91.exe	28
PID 952 wrote to memory of 1032	952	1b983c1ad539fc534debcece0e1bef91.exe	28

C:\Users\Admin\AppData\Local\Temp\1b983c1ad539fc534debcece0e1bef91.exe
"C:\Users\Admin\AppData\Local\Temp\1b983c1ad539fc534debcece0e1bef91.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 952 -s 540
  2⤵
  PID:1032

memory/952-0-0x0000000000800000-0x0000000000808000-memory.dmp

Filesize
32KB

Download
memory/952-1-0x000007FEF5C60000-0x000007FEF664C000-memory.dmp

Filesize
9.9MB

Download
memory/952-2-0x000000001B040000-0x000000001B0C0000-memory.dmp

Filesize
512KB

Download
memory/952-3-0x000007FEF5C60000-0x000007FEF664C000-memory.dmp

Filesize
9.9MB

Download
memory/952-4-0x000000001B040000-0x000000001B0C0000-memory.dmp

Filesize
512KB

Download