4821631c5362445a1c010c07395d5b4986fed7fc42e1243a48ac7037249f4ec9

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 20:37

Target

f66fbe073bd72593be0dcc855e367438.exe
Size

23KB
MD5

f66fbe073bd72593be0dcc855e367438
SHA1

f67e3759d1029a76cb734e1493ccccb5ad95a14b
SHA256

4821631c5362445a1c010c07395d5b4986fed7fc42e1243a48ac7037249f4ec9
SHA512

c84859e7955220a6ef1069c2ad75181a621bbab9281837f629112dfaa466acd384fa02baa4da894f9a3bb3f28464a5184b8e195277cbc7d9a2cfc65261746f28
SSDEEP

384:OdfxOXCEGsxkXykUptQ+RgktKTzHEquWtm6LdPgzb99SuHRvuYEHOVj44hCAz:OlgXssxkXCptQ+ekkThabvXRUH34hCM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 1528	1436	f66fbe073bd72593be0dcc855e367438.exe	28
PID 1436 wrote to memory of 1528	1436	f66fbe073bd72593be0dcc855e367438.exe	28
PID 1436 wrote to memory of 1528	1436	f66fbe073bd72593be0dcc855e367438.exe	28

C:\Users\Admin\AppData\Local\Temp\f66fbe073bd72593be0dcc855e367438.exe
"C:\Users\Admin\AppData\Local\Temp\f66fbe073bd72593be0dcc855e367438.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1436 -s 588
  2⤵
  PID:1528

memory/1436-0-0x0000000001320000-0x000000000132A000-memory.dmp

Filesize
40KB

Download
memory/1436-1-0x000007FEF56A0000-0x000007FEF608C000-memory.dmp

Filesize
9.9MB

Download
memory/1436-2-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/1436-3-0x000007FEF56A0000-0x000007FEF608C000-memory.dmp

Filesize
9.9MB

Download
memory/1436-4-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download