6255a85b962b24467b2398b17574bfee86e74093e884c7f229f69a267b6639db

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23-01-2024 15:39

Target

6255a85b962b24467b2398b17574bfee86e74093e884c7f229f69a267b6639db.exe
Size

6KB
MD5

80a8578462e67e5eb6c2b39e7e85b618
SHA1

9c75d1bd3962b1e125e1cea967f2c274de9a7b5b
SHA256

6255a85b962b24467b2398b17574bfee86e74093e884c7f229f69a267b6639db
SHA512

a68e2dc22bf08432595df677c86bd75179d35799e0b20f6614f8bff8bcbc88615162da4b65dad57d4e2c6173b9da7c8de1a2e9505c61c9afba30cf26d371ccc0
SSDEEP

48:S7bt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9uLO:a0mIGnFc/38+N4ZHJWSY9FI5WqEx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1880	1972	6255a85b962b24467b2398b17574bfee86e74093e884c7f229f69a267b6639db.exe	28
PID 1972 wrote to memory of 1880	1972	6255a85b962b24467b2398b17574bfee86e74093e884c7f229f69a267b6639db.exe	28
PID 1972 wrote to memory of 1880	1972	6255a85b962b24467b2398b17574bfee86e74093e884c7f229f69a267b6639db.exe	28

C:\Users\Admin\AppData\Local\Temp\6255a85b962b24467b2398b17574bfee86e74093e884c7f229f69a267b6639db.exe
"C:\Users\Admin\AppData\Local\Temp\6255a85b962b24467b2398b17574bfee86e74093e884c7f229f69a267b6639db.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1972 -s 32
  2⤵
  PID:1880