37af75a29d8d0038107c24983114bc69f980ebf1a4ad00d1a45ef89a17eacec8

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-01-2024 04:32

Target

37af75a29d8d0038107c24983114bc69f980ebf1a4ad00d1a45ef89a17eacec8.exe
Size

6KB
MD5

49e45a7ed4ccb4ffa16a49b4a8d0343b
SHA1

e1e7e0ecd3bc93bb5564ffab6fe09ab04f022502
SHA256

37af75a29d8d0038107c24983114bc69f980ebf1a4ad00d1a45ef89a17eacec8
SHA512

f93d5a718b35729e5e1656a3e9bedf7ec233d529343510afae303c108a4880b677426b17b6c514973b7f24f8981e3bfba89a124ba5a139cbc34a802844a64ce8
SSDEEP

48:SRbt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9uYO:s0mIGnFc/38+N4ZHJWSY9FI5Wqhx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 2276	828	37af75a29d8d0038107c24983114bc69f980ebf1a4ad00d1a45ef89a17eacec8.exe	28
PID 828 wrote to memory of 2276	828	37af75a29d8d0038107c24983114bc69f980ebf1a4ad00d1a45ef89a17eacec8.exe	28
PID 828 wrote to memory of 2276	828	37af75a29d8d0038107c24983114bc69f980ebf1a4ad00d1a45ef89a17eacec8.exe	28

C:\Users\Admin\AppData\Local\Temp\37af75a29d8d0038107c24983114bc69f980ebf1a4ad00d1a45ef89a17eacec8.exe
"C:\Users\Admin\AppData\Local\Temp\37af75a29d8d0038107c24983114bc69f980ebf1a4ad00d1a45ef89a17eacec8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 828 -s 32
  2⤵
  PID:2276