c4d5dbbae1099a7acfd402efc3aa1e527937b0e226ff713abd9cf35b64dec83e

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05-01-2024 01:35

Target

c4d5dbbae1099a7acfd402efc3aa1e527937b0e226ff713abd9cf35b64dec83e.exe
Size

54KB
MD5

59aa6c87b11d86e248eab0abadfa06cc
SHA1

efb50b0f09d44e02d181991cf080502e1e5bee3d
SHA256

c4d5dbbae1099a7acfd402efc3aa1e527937b0e226ff713abd9cf35b64dec83e
SHA512

f6cd98e95f344ba3aed181b38716d856a2a65989ce3eac91b46fa86981316045cf7f7f92220a42820a61373aec63d6439b73e83e687f26d63c0f480e3e5fe312
SSDEEP

768:KEeZoVVKasPsHqcDm3LR4070kB56t7/5oWN+bJV23E2/tIJAMxkE9:eiVCcDeP70kB56TKWN+bJ8Z/tIRxJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2000	1716	c4d5dbbae1099a7acfd402efc3aa1e527937b0e226ff713abd9cf35b64dec83e.exe	29
PID 1716 wrote to memory of 2000	1716	c4d5dbbae1099a7acfd402efc3aa1e527937b0e226ff713abd9cf35b64dec83e.exe	29
PID 1716 wrote to memory of 2000	1716	c4d5dbbae1099a7acfd402efc3aa1e527937b0e226ff713abd9cf35b64dec83e.exe	29

C:\Users\Admin\AppData\Local\Temp\c4d5dbbae1099a7acfd402efc3aa1e527937b0e226ff713abd9cf35b64dec83e.exe
"C:\Users\Admin\AppData\Local\Temp\c4d5dbbae1099a7acfd402efc3aa1e527937b0e226ff713abd9cf35b64dec83e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1716 -s 492
  2⤵
  PID:2000

memory/1716-0-0x00000000002A0000-0x00000000002B0000-memory.dmp

Filesize
64KB

Download
memory/1716-1-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

Filesize
9.9MB

Download
memory/1716-2-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

Filesize
9.9MB

Download