8a7cd4f33c6b253d6bab7dff749290df04ce191a7e9e7fa6fd8c8ff48ba0b858

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 14:57

Target

d06ecb3c4bdce7d7d99af65c7e4a2fe7.exe
Size

6KB
MD5

d06ecb3c4bdce7d7d99af65c7e4a2fe7
SHA1

432cb9bd7fd91276e586204ce90dea55a613cd23
SHA256

8a7cd4f33c6b253d6bab7dff749290df04ce191a7e9e7fa6fd8c8ff48ba0b858
SHA512

8d90eb76da392bac5ae252d50881ba9f4b218fad18e565af620bf7d9fcc7b755fcccd8073ca5d0a761ee41d4a2fc52e5066fa93e1e79197d785cde29477cef4d
SSDEEP

48:S8bt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9u/O:h0mIGnFc/38+N4ZHJWSY9FI5Wq4x

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 1416	2216	d06ecb3c4bdce7d7d99af65c7e4a2fe7.exe	14
PID 2216 wrote to memory of 1416	2216	d06ecb3c4bdce7d7d99af65c7e4a2fe7.exe	14
PID 2216 wrote to memory of 1416	2216	d06ecb3c4bdce7d7d99af65c7e4a2fe7.exe	14

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2216 -s 32
1⤵
PID:1416

C:\Users\Admin\AppData\Local\Temp\d06ecb3c4bdce7d7d99af65c7e4a2fe7.exe
"C:\Users\Admin\AppData\Local\Temp\d06ecb3c4bdce7d7d99af65c7e4a2fe7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2216