c7f81a341680ae065f723001fbf8c357cd2e47ffe6909df677fa3a384b96bb4b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 12:40

Target

c7f81a341680ae065f723001fbf8c357cd2e47ffe6909df677fa3a384b96bb4b.exe
Size

5.2MB
MD5

7bc351ee6acd409ea61924164a23890e
SHA1

147902ff8b2cfb4aff21eaeec39b20594f9f98f3
SHA256

c7f81a341680ae065f723001fbf8c357cd2e47ffe6909df677fa3a384b96bb4b
SHA512

c71d96fda74072717d7240b0119a9c66d92fee9c2afb3cc20eebb8e87812bdc4401dff1b88f5284a109dd548e187f0a4eb97253a49d43973bee52433cc71bbae
SSDEEP

49152:vD2NiYvGr7lS2FkPHIgOc3WzdqTemWS1nhCHzqLqYJg6/zx:K

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c7f81a341680ae065f723001fbf8c357cd2e47ffe6909df677fa3a384b96bb4b.exe

description	pid	process	target process
PID 3012 wrote to memory of 2020	3012	c7f81a341680ae065f723001fbf8c357cd2e47ffe6909df677fa3a384b96bb4b.exe	WerFault.exe
PID 3012 wrote to memory of 2020	3012	c7f81a341680ae065f723001fbf8c357cd2e47ffe6909df677fa3a384b96bb4b.exe	WerFault.exe
PID 3012 wrote to memory of 2020	3012	c7f81a341680ae065f723001fbf8c357cd2e47ffe6909df677fa3a384b96bb4b.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c7f81a341680ae065f723001fbf8c357cd2e47ffe6909df677fa3a384b96bb4b.exe
"C:\Users\Admin\AppData\Local\Temp\c7f81a341680ae065f723001fbf8c357cd2e47ffe6909df677fa3a384b96bb4b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3012

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3012 -s 520
2⤵
PID:2020

memory/3012-0-0x0000000000AA0000-0x0000000000FD4000-memory.dmp

Filesize
5.2MB

Download
memory/3012-1-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp

Filesize
9.9MB

Download
memory/3012-2-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp

Filesize
9.9MB

Download