69c9e9607feb1ae927ac86c060fa83253ab979e8828cfc0cee1f14e79ac6302b

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 09:28

Target

63d5c3b60935f7bc5c2dd5f3629f570e.exe
Size

6KB
MD5

63d5c3b60935f7bc5c2dd5f3629f570e
SHA1

f6bb3a2356c3ca08e4272ce299293a4dc644824a
SHA256

69c9e9607feb1ae927ac86c060fa83253ab979e8828cfc0cee1f14e79ac6302b
SHA512

f298a5da0171061ee2909c4a9ffe2113be3403d0c12671f8f34e5c58dd712deb57c67f55bd9fa52ef74fcf032c608428bb0aed4ba3548db4d4d746c4bdebc3ab
SSDEEP

48:SZbt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9u8O:I0mIGnFc/38+N4ZHJWSY9FI5Wqdx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1648	2420	63d5c3b60935f7bc5c2dd5f3629f570e.exe	28
PID 2420 wrote to memory of 1648	2420	63d5c3b60935f7bc5c2dd5f3629f570e.exe	28
PID 2420 wrote to memory of 1648	2420	63d5c3b60935f7bc5c2dd5f3629f570e.exe	28

C:\Users\Admin\AppData\Local\Temp\63d5c3b60935f7bc5c2dd5f3629f570e.exe
"C:\Users\Admin\AppData\Local\Temp\63d5c3b60935f7bc5c2dd5f3629f570e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2420 -s 32
  2⤵
  PID:1648