897309f2c3f8d2a8b1d83d464be8b2f63040815f80b327de069b0cdd6694d6c9

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 12:58

Target

4649b4bf42d7145fb85f8a0335220c70.exe
Size

315KB
MD5

4649b4bf42d7145fb85f8a0335220c70
SHA1

0775b2898bc6cac50f0c1c19e093006db8a69718
SHA256

897309f2c3f8d2a8b1d83d464be8b2f63040815f80b327de069b0cdd6694d6c9
SHA512

312ea5c4bbdf65a85f825a7888817a4594394cae187815a1e82d39c21e5298ad06e70e6e7c8d8dedcbf7d3c4c52dfd8ca19414ae6cda7aed6fbd77b0e6dd8f52
SSDEEP

6144:rPiI5Uv6XFR0SrbVLFMP4zpzOiXIJSmTb6McaTAIkOgbIIdR4SWUhauS4GpykDjH:rPiI5Uv6XFR0SrBLFpzjIJSmTb6McaTD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2304	2284	4649b4bf42d7145fb85f8a0335220c70.exe	28
PID 2284 wrote to memory of 2304	2284	4649b4bf42d7145fb85f8a0335220c70.exe	28
PID 2284 wrote to memory of 2304	2284	4649b4bf42d7145fb85f8a0335220c70.exe	28

C:\Users\Admin\AppData\Local\Temp\4649b4bf42d7145fb85f8a0335220c70.exe
"C:\Users\Admin\AppData\Local\Temp\4649b4bf42d7145fb85f8a0335220c70.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2284 -s 564
  2⤵
  PID:2304

memory/2284-0-0x00000000012E0000-0x0000000001334000-memory.dmp

Filesize
336KB

Download
memory/2284-1-0x000007FEF56C0000-0x000007FEF60AC000-memory.dmp

Filesize
9.9MB

Download
memory/2284-2-0x000007FEF56C0000-0x000007FEF60AC000-memory.dmp

Filesize
9.9MB

Download