55e8a8da4ef411641adc656b8a770f76c069a1741b6bf7a17eabb709f6b6733b

Analysis

max time kernel
142s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 05:46

Target

5822914d38cfbb85ba045f6ea0bdd3cd.exe
Size

259KB
MD5

5822914d38cfbb85ba045f6ea0bdd3cd
SHA1

9675e82a2333e76f5fc83f09a1a15b0fc577f99b
SHA256

55e8a8da4ef411641adc656b8a770f76c069a1741b6bf7a17eabb709f6b6733b
SHA512

1ada07128c7a2d6ee9e4ecdbc91362b66a9aacbf742e68a105683ddfb37d67300118a18a812d2b7460a95431f14eb47e7c6b066cd7e5e9361093449f0451b2fe
SSDEEP

3072:J8xLNK3wKYP4ZTTmb4u+gvaR7xSstIp/sfuQJGmmTfEBQgMsAV:Js83u4JqbTNIjtIpCuQi82mAV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2696	2460	5822914d38cfbb85ba045f6ea0bdd3cd.exe	29
PID 2460 wrote to memory of 2696	2460	5822914d38cfbb85ba045f6ea0bdd3cd.exe	29
PID 2460 wrote to memory of 2696	2460	5822914d38cfbb85ba045f6ea0bdd3cd.exe	29

C:\Users\Admin\AppData\Local\Temp\5822914d38cfbb85ba045f6ea0bdd3cd.exe
"C:\Users\Admin\AppData\Local\Temp\5822914d38cfbb85ba045f6ea0bdd3cd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2460 -s 68
  2⤵
  PID:2696

memory/2460-0-0x0000000000450000-0x0000000000473000-memory.dmp

Filesize
140KB

Download
memory/2460-1-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download