a6d5c264c22f7827fca4b9c51c8d3f47a4ea6370d14ab72e8fd414f484e96817

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-01-2024 18:31

Target

a6d5c264c22f7827fca4b9c51c8d3f47a4ea6370d14ab72e8fd414f484e96817.exe
Size

1.7MB
MD5

fb9425609b3244c2cfb954d6d0f9e01b
SHA1

1cf702b2c62f0caca960d4d9acb23dc7e5175ad1
SHA256

a6d5c264c22f7827fca4b9c51c8d3f47a4ea6370d14ab72e8fd414f484e96817
SHA512

e2f30d0a5da50fd54f6dbaebd94d071fc58bf7b8e14e086c1d72476edd10e0cdae8a10619c5ea9b4fcfcc6b995ccd847933e3f49e7203fda04ac531f8b66af26
SSDEEP

24576:FnPRZrrOei2/mjEIhDaMMbJoqdj5mYEbImiA8CkT8DSVXT5Xk1W8B/Xya:Fn5fbJoQj5mZE4oxXT5Xk1WQv1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a6d5c264c22f7827fca4b9c51c8d3f47a4ea6370d14ab72e8fd414f484e96817.exe

description	pid	process	target process
PID 2268 wrote to memory of 2180	2268	a6d5c264c22f7827fca4b9c51c8d3f47a4ea6370d14ab72e8fd414f484e96817.exe	WerFault.exe
PID 2268 wrote to memory of 2180	2268	a6d5c264c22f7827fca4b9c51c8d3f47a4ea6370d14ab72e8fd414f484e96817.exe	WerFault.exe
PID 2268 wrote to memory of 2180	2268	a6d5c264c22f7827fca4b9c51c8d3f47a4ea6370d14ab72e8fd414f484e96817.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a6d5c264c22f7827fca4b9c51c8d3f47a4ea6370d14ab72e8fd414f484e96817.exe
"C:\Users\Admin\AppData\Local\Temp\a6d5c264c22f7827fca4b9c51c8d3f47a4ea6370d14ab72e8fd414f484e96817.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2268 -s 144
  2⤵
  PID:2180