336be3a20ae8a36962ffd26b1ec7fb0ec2274a860dd9423b16ff817d29f1908a

Analysis

max time kernel
122s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 15:12

Target

70f166f51e58ef7651a6e567404c71e499d9c2b6e01fc6ae176fd290e91f3aad.exe
Size

31KB
MD5

87c3f1f322b6ca9f96ef6fd5737ec0ce
SHA1

621e5aa579a1fbcc8f81cd5ff0390608fde82057
SHA256

70f166f51e58ef7651a6e567404c71e499d9c2b6e01fc6ae176fd290e91f3aad
SHA512

3db7047fdf8b5e1aed619cca544e35ae128e47afef2786c91e4ea3a9a259e17d058a4b9a839caf83305725b1d9bfe522c0550e1642cb4e849285317a7a290d27
SSDEEP

768:9Ta1JHCQtOG/UbNjCVXdgbcoC+qDd32DOT:9Ta11t4JKXdgbcoC+w1T

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2832	2660	70f166f51e58ef7651a6e567404c71e499d9c2b6e01fc6ae176fd290e91f3aad.exe	28
PID 2660 wrote to memory of 2832	2660	70f166f51e58ef7651a6e567404c71e499d9c2b6e01fc6ae176fd290e91f3aad.exe	28
PID 2660 wrote to memory of 2832	2660	70f166f51e58ef7651a6e567404c71e499d9c2b6e01fc6ae176fd290e91f3aad.exe	28

C:\Users\Admin\AppData\Local\Temp\70f166f51e58ef7651a6e567404c71e499d9c2b6e01fc6ae176fd290e91f3aad.exe
"C:\Users\Admin\AppData\Local\Temp\70f166f51e58ef7651a6e567404c71e499d9c2b6e01fc6ae176fd290e91f3aad.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2660 -s 524
  2⤵
  PID:2832

memory/2660-0-0x00000000000A0000-0x00000000000AE000-memory.dmp

Filesize
56KB

Download
memory/2660-1-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

Filesize
9.9MB

Download
memory/2660-2-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

Filesize
9.9MB

Download