1663d0e2a196d35ef4dbf4761165ea29c59d3d75fd97609c2cbce9e00ed1643a

Analysis

max time kernel
128s
max time network
34s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 07:13

Target

4313edbd71caabd6c7acd0cd1fb3f0ef.exe
Size

176KB
MD5

4313edbd71caabd6c7acd0cd1fb3f0ef
SHA1

ceb4a0c804112d7b4281cb0bd055ffdf5b9e29f7
SHA256

1663d0e2a196d35ef4dbf4761165ea29c59d3d75fd97609c2cbce9e00ed1643a
SHA512

f1280ef4b2f5fb18b835c98eefb97de12266b0ad6ee8b9d27b72f9aca9f19ab0f6fe34e22e6e81cb78ab645d627bb6ef7a339e611eeada531204f578e2398931
SSDEEP

3072:7B6hE3HcMmffIy0CPohMCPrfNs7aMmUHtj4bnFA6cirQG9QOkimjzUcSClLeNYqE:7B6hkmfgyV4RaKbnaSd9yjsxPSf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2996	1792	4313edbd71caabd6c7acd0cd1fb3f0ef.exe	29
PID 1792 wrote to memory of 2996	1792	4313edbd71caabd6c7acd0cd1fb3f0ef.exe	29
PID 1792 wrote to memory of 2996	1792	4313edbd71caabd6c7acd0cd1fb3f0ef.exe	29

C:\Users\Admin\AppData\Local\Temp\4313edbd71caabd6c7acd0cd1fb3f0ef.exe
"C:\Users\Admin\AppData\Local\Temp\4313edbd71caabd6c7acd0cd1fb3f0ef.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1792 -s 556
  2⤵
  PID:2996

memory/1792-0-0x0000000001030000-0x0000000001062000-memory.dmp

Filesize
200KB

Download
memory/1792-1-0x000007FEF5590000-0x000007FEF5F7C000-memory.dmp

Filesize
9.9MB

Download
memory/1792-2-0x000007FEF5590000-0x000007FEF5F7C000-memory.dmp

Filesize
9.9MB

Download