51627e943f397a42f0a8e6a77ab5f7e1f39d835aed82fa2e90a6a1acbdd9df40

Analysis

max time kernel
167s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2024, 21:20

Target

51627e943f397a42f0a8e6a77ab5f7e1f39d835aed82fa2e90a6a1acbdd9df40.exe
Size

6KB
MD5

339cb38567d9e83d2d7a8ba38ea2ad40
SHA1

b08dee149ed0366683b1c05d35a246aa93622630
SHA256

51627e943f397a42f0a8e6a77ab5f7e1f39d835aed82fa2e90a6a1acbdd9df40
SHA512

69ecd9298362cf7dc49aa9108cabcee2d22940ab64b975d02576b6bd55d4d0fcb51aed719094a16acd8e9b9835109b643f3c77d17cd9305bfb8f2e430bda6c44
SSDEEP

48:Sabt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9uEO:/0mIGnFc/38+N4ZHJWSY9FI5Wq1x

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 3924	2692	51627e943f397a42f0a8e6a77ab5f7e1f39d835aed82fa2e90a6a1acbdd9df40.exe	94
PID 2692 wrote to memory of 3924	2692	51627e943f397a42f0a8e6a77ab5f7e1f39d835aed82fa2e90a6a1acbdd9df40.exe	94

C:\Users\Admin\AppData\Local\Temp\51627e943f397a42f0a8e6a77ab5f7e1f39d835aed82fa2e90a6a1acbdd9df40.exe
"C:\Users\Admin\AppData\Local\Temp\51627e943f397a42f0a8e6a77ab5f7e1f39d835aed82fa2e90a6a1acbdd9df40.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2692 -s 152
  2⤵
  PID:3924