4953439b1c25e66318aedd8752f3c9705a40f4736b25f5186662e75f7db6ffd3

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 13:53

Target

2358590937536624e41eef781339ceb0.exe
Size

162KB
MD5

2358590937536624e41eef781339ceb0
SHA1

13ba3a035618359a56b4ae8629e22de55b314e79
SHA256

4953439b1c25e66318aedd8752f3c9705a40f4736b25f5186662e75f7db6ffd3
SHA512

a63113419364e26bde3463c7a89ee044f78d2861685de191f6921007a79e667dfbe76d76b4e293165f93f62ddcced4cc1ea978d03b03285b086606e3bd31b0a0
SSDEEP

3072:X4etlOI/VfqA1F12oivUY9J/R2YBzpR1E3IqB6jc:X4K4I/VyA1FkouH91R2YBzv1E3hB6j

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2920	2164	2358590937536624e41eef781339ceb0.exe	16
PID 2164 wrote to memory of 2920	2164	2358590937536624e41eef781339ceb0.exe	16
PID 2164 wrote to memory of 2920	2164	2358590937536624e41eef781339ceb0.exe	16

C:\Users\Admin\AppData\Local\Temp\2358590937536624e41eef781339ceb0.exe
"C:\Users\Admin\AppData\Local\Temp\2358590937536624e41eef781339ceb0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2164 -s 524
  2⤵
  PID:2920

memory/2164-0-0x0000000001140000-0x000000000116E000-memory.dmp

Filesize
184KB

Download
memory/2164-1-0x000007FEF5F90000-0x000007FEF697C000-memory.dmp

Filesize
9.9MB

Download
memory/2164-2-0x000007FEF5F90000-0x000007FEF697C000-memory.dmp

Filesize
9.9MB

Download