9ceafdb2511e2841698c7a467137b39c7ac65690413f7d5b4dacecb5f0451c97

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 21:32

Target

9ceafdb2511e2841698c7a467137b39c7ac65690413f7d5b4dacecb5f0451c97.exe
Size

6KB
MD5

f75b0b3592177a56ba3e63d1fe66c372
SHA1

5181af15225429aa272fd56421f8c31509634d9f
SHA256

9ceafdb2511e2841698c7a467137b39c7ac65690413f7d5b4dacecb5f0451c97
SHA512

26ac59a570f1543859c5a8ec3e11d8e01f3060750e24e89b86326fa175463a94c66f650336eea0eb63afa03567786e344aee47203502bdbd823311eaaa316a04
SSDEEP

48:SQbt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9uGO:V0mIGnFc/38+N4ZHJWSY9FI5Wq/x

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2148	2460	9ceafdb2511e2841698c7a467137b39c7ac65690413f7d5b4dacecb5f0451c97.exe	28
PID 2460 wrote to memory of 2148	2460	9ceafdb2511e2841698c7a467137b39c7ac65690413f7d5b4dacecb5f0451c97.exe	28
PID 2460 wrote to memory of 2148	2460	9ceafdb2511e2841698c7a467137b39c7ac65690413f7d5b4dacecb5f0451c97.exe	28

C:\Users\Admin\AppData\Local\Temp\9ceafdb2511e2841698c7a467137b39c7ac65690413f7d5b4dacecb5f0451c97.exe
"C:\Users\Admin\AppData\Local\Temp\9ceafdb2511e2841698c7a467137b39c7ac65690413f7d5b4dacecb5f0451c97.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2460 -s 32
  2⤵
  PID:2148