ce67c127387dbcff2c2f9dd474ed7ab03e99f919a4ee2e3ae227a75c0d047aa2

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 04:39

Target

ce67c127387dbcff2c2f9dd474ed7ab03e99f919a4ee2e3ae227a75c0d047aa2.exe
Size

6KB
MD5

a6106cc5b457f7d10b78865411b43ab5
SHA1

9f668c5c655f526f0fee661a1ab0c57d98d6ea7f
SHA256

ce67c127387dbcff2c2f9dd474ed7ab03e99f919a4ee2e3ae227a75c0d047aa2
SHA512

25d6de904b17ea51748bd0688327766d430a3247414983ea288e245f33caacb4923b514523990c4f0f970e6f55e8175b69e1110691e96bf12bbef27806ec6a0a
SSDEEP

48:STbt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9ugO:i0mIGnFc/38+N4ZHJWSY9FI5WqJx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 1784	2880	ce67c127387dbcff2c2f9dd474ed7ab03e99f919a4ee2e3ae227a75c0d047aa2.exe	28
PID 2880 wrote to memory of 1784	2880	ce67c127387dbcff2c2f9dd474ed7ab03e99f919a4ee2e3ae227a75c0d047aa2.exe	28
PID 2880 wrote to memory of 1784	2880	ce67c127387dbcff2c2f9dd474ed7ab03e99f919a4ee2e3ae227a75c0d047aa2.exe	28

C:\Users\Admin\AppData\Local\Temp\ce67c127387dbcff2c2f9dd474ed7ab03e99f919a4ee2e3ae227a75c0d047aa2.exe
"C:\Users\Admin\AppData\Local\Temp\ce67c127387dbcff2c2f9dd474ed7ab03e99f919a4ee2e3ae227a75c0d047aa2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2880 -s 32
  2⤵
  PID:1784