9fa1812ca983b40e98bc4a811b5d43c378e606e83e4fae7d67473bd8ec083602

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 19:32

Target

9fa1812ca983b40e98bc4a811b5d43c378e606e83e4fae7d67473bd8ec083602.exe
Size

6KB
MD5

e45c3b3fef2116e524fd69cae90daca0
SHA1

26b1e9cb915fcc02b2352ff93f485b944170af52
SHA256

9fa1812ca983b40e98bc4a811b5d43c378e606e83e4fae7d67473bd8ec083602
SHA512

b1ce8d7753eebd061d8619e169aa61f2913cce26d7c986bcc3de6913e2771dd669b1fef3a77981b45598e2d78abd3a4189db2bea98960485c7b732f3c866b607
SSDEEP

48:S3bt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9uPO:W0mIGnFc/38+N4ZHJWSY9FI5Wqwx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2456	2536	9fa1812ca983b40e98bc4a811b5d43c378e606e83e4fae7d67473bd8ec083602.exe	28
PID 2536 wrote to memory of 2456	2536	9fa1812ca983b40e98bc4a811b5d43c378e606e83e4fae7d67473bd8ec083602.exe	28
PID 2536 wrote to memory of 2456	2536	9fa1812ca983b40e98bc4a811b5d43c378e606e83e4fae7d67473bd8ec083602.exe	28

C:\Users\Admin\AppData\Local\Temp\9fa1812ca983b40e98bc4a811b5d43c378e606e83e4fae7d67473bd8ec083602.exe
"C:\Users\Admin\AppData\Local\Temp\9fa1812ca983b40e98bc4a811b5d43c378e606e83e4fae7d67473bd8ec083602.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2536 -s 32
  2⤵
  PID:2456