63ca6f29f3c3e34a272cd01441d9a19f2c8a378f0d470e780cf4d1ffa1ea0d09

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:11

Target

0b3a94da4335ee5451cda8f7cfb64457.exe
Size

6KB
MD5

0b3a94da4335ee5451cda8f7cfb64457
SHA1

19025065eba58e4f82d3f49338acf30b830c69e4
SHA256

63ca6f29f3c3e34a272cd01441d9a19f2c8a378f0d470e780cf4d1ffa1ea0d09
SHA512

45e7d3020ab5f5a27ae1311bda011dfdc1d7ea341e9d9f88a229b38a6973dd66daf0b23ed6f9383964c6143222c2c9c5bcad9833cb48a0bf6f25307cd7f40d50
SSDEEP

48:Stbt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9ulO:Y0mIGnFc/38+N4ZHJWSY9FI5Wqux

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1180	2088	0b3a94da4335ee5451cda8f7cfb64457.exe	28
PID 2088 wrote to memory of 1180	2088	0b3a94da4335ee5451cda8f7cfb64457.exe	28
PID 2088 wrote to memory of 1180	2088	0b3a94da4335ee5451cda8f7cfb64457.exe	28

C:\Users\Admin\AppData\Local\Temp\0b3a94da4335ee5451cda8f7cfb64457.exe
"C:\Users\Admin\AppData\Local\Temp\0b3a94da4335ee5451cda8f7cfb64457.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2088 -s 32
  2⤵
  PID:1180