57412669945c8d9eb6287dad5185c597b7ea14262b2c82ac2b76cad9b5fc3022

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 23:23

Target

3f4abdbe5389f2361c89d103e63706ab.exe
Size

2.7MB
MD5

3f4abdbe5389f2361c89d103e63706ab
SHA1

4097f24318808ec35672e143eb9a80b23119400e
SHA256

57412669945c8d9eb6287dad5185c597b7ea14262b2c82ac2b76cad9b5fc3022
SHA512

c6d35402389935bcf9aa382e8ceb577544e89477dfaa1213f00f99b46273b6c23f0f38de33fe557a3e0a7a02b76fb47807da1a0b7dd163363799f2d87165fc5e
SSDEEP

49152:l0g7mM+M6RkMkIM7I0671LfUjsNBk9/fw2BwfmM0fh35DMnCIjtAyw79:EM+M6RkMkIM73sNi9XwgwfoI55+79

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 936	2372	3f4abdbe5389f2361c89d103e63706ab.exe	28
PID 2372 wrote to memory of 936	2372	3f4abdbe5389f2361c89d103e63706ab.exe	28
PID 2372 wrote to memory of 936	2372	3f4abdbe5389f2361c89d103e63706ab.exe	28

C:\Users\Admin\AppData\Local\Temp\3f4abdbe5389f2361c89d103e63706ab.exe
"C:\Users\Admin\AppData\Local\Temp\3f4abdbe5389f2361c89d103e63706ab.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2372 -s 192
  2⤵
  PID:936