1cb1cdac9af8928a36d521a14349edd44ff9bc6629d6a546fd0ce72db1fc41ec

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-01-2024 14:30

Target

1cb1cdac9af8928a36d521a14349edd44ff9bc6629d6a546fd0ce72db1fc41ec.exe
Size

6KB
MD5

ecb57592c4efd08fd00e1db0d208b3bf
SHA1

664c0037c1869917e2a19b883e8f8ff122d542cf
SHA256

1cb1cdac9af8928a36d521a14349edd44ff9bc6629d6a546fd0ce72db1fc41ec
SHA512

2bc25ab31eb619d9001a5259839b7ea9deb7d97fedee5e7556a368f93d8fee43d1d3c856403ca5e9f20b35d3aa9692332d729aa5be6c266aeb72d8382dcbba45
SSDEEP

48:SVbt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9uzO:40mIGnFc/38+N4ZHJWSY9FI5Wqkx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 1660	2552	1cb1cdac9af8928a36d521a14349edd44ff9bc6629d6a546fd0ce72db1fc41ec.exe	5
PID 2552 wrote to memory of 1660	2552	1cb1cdac9af8928a36d521a14349edd44ff9bc6629d6a546fd0ce72db1fc41ec.exe	5
PID 2552 wrote to memory of 1660	2552	1cb1cdac9af8928a36d521a14349edd44ff9bc6629d6a546fd0ce72db1fc41ec.exe	5

C:\Users\Admin\AppData\Local\Temp\1cb1cdac9af8928a36d521a14349edd44ff9bc6629d6a546fd0ce72db1fc41ec.exe
"C:\Users\Admin\AppData\Local\Temp\1cb1cdac9af8928a36d521a14349edd44ff9bc6629d6a546fd0ce72db1fc41ec.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2552 -s 32
  2⤵
  PID:1660