a2f41ea2ee7b586fd93dbf1f2938630fd2500648194bd1e7c9583cf0bd9d7184

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23/01/2024, 17:59

Target

703391992d811fc2074d710193132c72.exe
Size

77KB
MD5

703391992d811fc2074d710193132c72
SHA1

40a08b3eb77ec5e6b8819d4a23f52329136be641
SHA256

a2f41ea2ee7b586fd93dbf1f2938630fd2500648194bd1e7c9583cf0bd9d7184
SHA512

aae90ffc67100ed6e8c20c8691ec65a6c98826d07d22f4df003acd853ae9074182c82467c204ddcdcd39ed550a7901368c33ce17fa6d0681d1f9ca9c4412f938
SSDEEP

768:fYKlOF3oW3CvoXXbOfq1Mkg2s6gRc4cBWnmhb7TO2sg/X7HJlLWH9fk0oK/YhxM7:fLlGoWyvqbOwgnc4cLKYuOMRxadE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2160	2420	703391992d811fc2074d710193132c72.exe	28
PID 2420 wrote to memory of 2160	2420	703391992d811fc2074d710193132c72.exe	28
PID 2420 wrote to memory of 2160	2420	703391992d811fc2074d710193132c72.exe	28

C:\Users\Admin\AppData\Local\Temp\703391992d811fc2074d710193132c72.exe
"C:\Users\Admin\AppData\Local\Temp\703391992d811fc2074d710193132c72.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2420 -s 536
  2⤵
  PID:2160

memory/2420-0-0x00000000003C0000-0x00000000003DA000-memory.dmp

Filesize
104KB

Download
memory/2420-1-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

Filesize
9.9MB

Download
memory/2420-2-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

Filesize
9.9MB

Download