35c0bf5344e25f96cf3e2199ed1c671ef2c9db1b5cb5baded5aac20c98787470

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 18:22

Target

342d75d05ada4d8a37f40584fe3fad86.exe
Size

2.5MB
MD5

342d75d05ada4d8a37f40584fe3fad86
SHA1

070fcddb8342fdd7673ed75042207c2d9da0cc89
SHA256

35c0bf5344e25f96cf3e2199ed1c671ef2c9db1b5cb5baded5aac20c98787470
SHA512

96ff7c0a2acc4122e4fde677d13e2c2ddbd42540cf8e9051fdcd5b79fcccfb911db506926c4d17f9adc02da13de1850d143643121a7a289a0de05cc576a2eda9
SSDEEP

49152:l0g7mM+M6RkMkIM7I067QoJdXN0BMOwLloBrughFlYvoGxUSJpXgLfUO:EM+M6RkMkIM7UJdXN0B7+sRsRXg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1268	1724	342d75d05ada4d8a37f40584fe3fad86.exe	28
PID 1724 wrote to memory of 1268	1724	342d75d05ada4d8a37f40584fe3fad86.exe	28
PID 1724 wrote to memory of 1268	1724	342d75d05ada4d8a37f40584fe3fad86.exe	28

C:\Users\Admin\AppData\Local\Temp\342d75d05ada4d8a37f40584fe3fad86.exe
"C:\Users\Admin\AppData\Local\Temp\342d75d05ada4d8a37f40584fe3fad86.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1724 -s 192
  2⤵
  PID:1268