bb24a3a84b1ef029b32f582f81b086a6f99cf9eb910d6fe912cd8a6811333e83

Analysis

max time kernel
121s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 21:31

Target

3d92d8e8e3b83efc21bc56e32bcbf683.exe
Size

2.5MB
MD5

3d92d8e8e3b83efc21bc56e32bcbf683
SHA1

f438d0d2129f7d30fa45c3298f28af9f80b5f2c7
SHA256

bb24a3a84b1ef029b32f582f81b086a6f99cf9eb910d6fe912cd8a6811333e83
SHA512

962cb6e345b644d7e695f5268bd3c87f7069c135268aebfb852d5a57281d978cb15ce8a260dfa4b4e580352808cd425f820bda77dd8c2f0adc41d1f0d9b829be
SSDEEP

49152:l0g7mM+M6RkMkIM7I067c9VfWboJdXN0BMOwLloBrugxljxCIabjKoh9Wj:EM+M6RkMkIM7L9FTJdXN0B7+s6IabjKV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2900	2672	3d92d8e8e3b83efc21bc56e32bcbf683.exe	28
PID 2672 wrote to memory of 2900	2672	3d92d8e8e3b83efc21bc56e32bcbf683.exe	28
PID 2672 wrote to memory of 2900	2672	3d92d8e8e3b83efc21bc56e32bcbf683.exe	28

C:\Users\Admin\AppData\Local\Temp\3d92d8e8e3b83efc21bc56e32bcbf683.exe
"C:\Users\Admin\AppData\Local\Temp\3d92d8e8e3b83efc21bc56e32bcbf683.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2672 -s 192
  2⤵
  PID:2900