9f9276689c1d1348f6a35f2a0c2b58fc3e562e21a9972efd3851509d51399534

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:40

Target

2a64b2b487557214bd2c14d3541a5a24.exe
Size

77KB
MD5

2a64b2b487557214bd2c14d3541a5a24
SHA1

580d381e65c1e6802db4808590c0806d900c0ff7
SHA256

9f9276689c1d1348f6a35f2a0c2b58fc3e562e21a9972efd3851509d51399534
SHA512

d1cfb73a9ef76959ec3bf9a4a1ebfa73437a2b549772c84f9141ce26efab268168d46594a28eafae93140e4e1f5b57adf64e026fd71a5e8d6705ac66cbbe1d8d
SSDEEP

1536:KoMkmbrOlm1QE2Hzh7vU4yKkYPAEBpbncvwXnrEAz6oUKXPOF93hUwoczXZoXkAn:tMkmbrOlm2bHzh7U4yKkYPAEBpbncvwV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2044	2220	2a64b2b487557214bd2c14d3541a5a24.exe	18
PID 2220 wrote to memory of 2044	2220	2a64b2b487557214bd2c14d3541a5a24.exe	18
PID 2220 wrote to memory of 2044	2220	2a64b2b487557214bd2c14d3541a5a24.exe	18

C:\Users\Admin\AppData\Local\Temp\2a64b2b487557214bd2c14d3541a5a24.exe
"C:\Users\Admin\AppData\Local\Temp\2a64b2b487557214bd2c14d3541a5a24.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2220 -s 528
  2⤵
  PID:2044

memory/2220-0-0x0000000000DB0000-0x0000000000DCA000-memory.dmp

Filesize
104KB

Download
memory/2220-1-0x000007FEF52E0000-0x000007FEF5CCC000-memory.dmp

Filesize
9.9MB

Download
memory/2220-2-0x000007FEF52E0000-0x000007FEF5CCC000-memory.dmp

Filesize
9.9MB

Download