4338ee94e2315cbca2b8dd50207e3f2fe4ecf428c1f01a432c21a830b17a17aa

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 03:33

Target

4338ee94e2315cbca2b8dd50207e3f2fe4ecf428c1f01a432c21a830b17a17aa.exe
Size

6KB
MD5

735859ad28ce06c88fae368a2c13d358
SHA1

0f8e8a44bacb8577a35c71f70be7fbe69acde783
SHA256

4338ee94e2315cbca2b8dd50207e3f2fe4ecf428c1f01a432c21a830b17a17aa
SHA512

8ef0f43b0ee919644a5f7dd5d3cbeb9647b129dd738a9e2caceb434ab3d4a6297b0143cbdfceba1c015e557701ecf153b79cc4fbd01c8c631c00782a1e26616d
SSDEEP

48:Sibt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9ujO:z0mIGnFc/38+N4ZHJWSY9FI5Wqcx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2308	2884	4338ee94e2315cbca2b8dd50207e3f2fe4ecf428c1f01a432c21a830b17a17aa.exe	28
PID 2884 wrote to memory of 2308	2884	4338ee94e2315cbca2b8dd50207e3f2fe4ecf428c1f01a432c21a830b17a17aa.exe	28
PID 2884 wrote to memory of 2308	2884	4338ee94e2315cbca2b8dd50207e3f2fe4ecf428c1f01a432c21a830b17a17aa.exe	28

C:\Users\Admin\AppData\Local\Temp\4338ee94e2315cbca2b8dd50207e3f2fe4ecf428c1f01a432c21a830b17a17aa.exe
"C:\Users\Admin\AppData\Local\Temp\4338ee94e2315cbca2b8dd50207e3f2fe4ecf428c1f01a432c21a830b17a17aa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2884 -s 32
  2⤵
  PID:2308