d4c7f10abceccb49de296b0fca308fb5c40f2a9b6938f27fa5e4365a6041d91e

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:49

Target

209a8de1f6ab8f9b9fe7a23a6d925faf.exe
Size

6KB
MD5

209a8de1f6ab8f9b9fe7a23a6d925faf
SHA1

8ffcde270b72dd144ec1a50adf58759504b23ee1
SHA256

d4c7f10abceccb49de296b0fca308fb5c40f2a9b6938f27fa5e4365a6041d91e
SHA512

a32c4792f0ac4f2f285d288af6fcbd3e48fc42325642b6ec9827326ad639352674f7f559fe230b08ca6c3133cfff135107e515f7ca24654967695bb41c372040
SSDEEP

48:SFbt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9uCO:Y0mIGnFc/38+N4ZHJWSY9FI5WqTx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2956	2856	209a8de1f6ab8f9b9fe7a23a6d925faf.exe	28
PID 2856 wrote to memory of 2956	2856	209a8de1f6ab8f9b9fe7a23a6d925faf.exe	28
PID 2856 wrote to memory of 2956	2856	209a8de1f6ab8f9b9fe7a23a6d925faf.exe	28

C:\Users\Admin\AppData\Local\Temp\209a8de1f6ab8f9b9fe7a23a6d925faf.exe
"C:\Users\Admin\AppData\Local\Temp\209a8de1f6ab8f9b9fe7a23a6d925faf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2856 -s 32
  2⤵
  PID:2956