24ca1ccadea86789ecfa651686910b20bd61a1ae775969b3cbf904d963df778c

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 05:22

Target

DomaIQ.exe
Size

357KB
MD5

539cc0298d9d8d474b673e8683e29566
SHA1

3f73a9b466b83de91c9f8a75b69cc7f4b21e5549
SHA256

dd8d0d76970a67b7255ffad7aef96012a8f76272d1c54fcc563bb93ac789d3fb
SHA512

f9cf0ed01c0499e0e4d0f8083c2a61514405f816f50b3fc9c0546c9e4ed3accde72092665fa5e6a1ff85153b3491f23eaf9323c162c7ef41e531acdc1fe819d2
SSDEEP

6144:wNHi7w5e5ToupfBuURZK/cNYTMedWB48X+3VtpqLLN4AIvAxp840:aHiuz0NYxDf/AIvAxGt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 3060	2188	DomaIQ.exe	28
PID 2188 wrote to memory of 3060	2188	DomaIQ.exe	28
PID 2188 wrote to memory of 3060	2188	DomaIQ.exe	28

C:\Users\Admin\AppData\Local\Temp\DomaIQ.exe
"C:\Users\Admin\AppData\Local\Temp\DomaIQ.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2188 -s 672
  2⤵
  PID:3060

memory/2188-0-0x0000000000350000-0x00000000003B0000-memory.dmp

Filesize
384KB

Download
memory/2188-1-0x0000000000140000-0x000000000014E000-memory.dmp

Filesize
56KB

Download
memory/2188-2-0x000007FEF5540000-0x000007FEF5F2C000-memory.dmp

Filesize
9.9MB

Download
memory/2188-3-0x000000001AF50000-0x000000001AFD0000-memory.dmp

Filesize
512KB

Download
memory/2188-4-0x000007FEF5540000-0x000007FEF5F2C000-memory.dmp

Filesize
9.9MB

Download
memory/2188-5-0x000000001AF50000-0x000000001AFD0000-memory.dmp

Filesize
512KB

Download