7c4a58eee1d0ad4c8c05b183faaa790f43a1162c5ade71ed26b7c735d581c941

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/01/2024, 14:24

Target

6fa7c166abc0a239e7e798fdcbf3ea24.exe
Size

42KB
MD5

6fa7c166abc0a239e7e798fdcbf3ea24
SHA1

953f034ce38121ac18b102a54405b10965bca087
SHA256

7c4a58eee1d0ad4c8c05b183faaa790f43a1162c5ade71ed26b7c735d581c941
SHA512

d53632bfce571421662853d8b6d54b5b26071dd0ed314544a89255054b8cb40b53833ac4fae530fb9c815f892be71055e4ca660ef855ef00fe5fb53b1c491739
SSDEEP

768:N+1NSy6M1OVh0j2ARgOvW7fawynAD65ok0iYbeMAxauPf2sSM5jj:N+/6zrkRET2AD65ok0iJzzPWM5j

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2208	2364	6fa7c166abc0a239e7e798fdcbf3ea24.exe	29
PID 2364 wrote to memory of 2208	2364	6fa7c166abc0a239e7e798fdcbf3ea24.exe	29
PID 2364 wrote to memory of 2208	2364	6fa7c166abc0a239e7e798fdcbf3ea24.exe	29

C:\Users\Admin\AppData\Local\Temp\6fa7c166abc0a239e7e798fdcbf3ea24.exe
"C:\Users\Admin\AppData\Local\Temp\6fa7c166abc0a239e7e798fdcbf3ea24.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2364 -s 100
  2⤵
  PID:2208

memory/2364-0-0x0000000100000000-0x000000010000F000-memory.dmp

Filesize
60KB

Download
memory/2364-1-0x0000000100000000-0x000000010000F000-memory.dmp

Filesize
60KB

Download