44f8528c9639dba967483ac5c3156a280c04e079afdd743a10a8ea4c3cb512d8

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 17:32

Target

44f8528c9639dba967483ac5c3156a280c04e079afdd743a10a8ea4c3cb512d8.exe
Size

6KB
MD5

b155ca55406dbd9a60ba6c80cd93abea
SHA1

26d4142bb26d517d4f0cac04fe09300631e17095
SHA256

44f8528c9639dba967483ac5c3156a280c04e079afdd743a10a8ea4c3cb512d8
SHA512

cd0afba406a9e02b3b0560949bc27f3070ff1a53b0815dbc78434e954a2793c46ad539868e4744a647b7ea320c893cda6a51fd20e91c13ca868af782f7f847c0
SSDEEP

48:S8bt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9u9O:50mIGnFc/38+N4ZHJWSY9FI5WqWx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1372	2372	44f8528c9639dba967483ac5c3156a280c04e079afdd743a10a8ea4c3cb512d8.exe	28
PID 2372 wrote to memory of 1372	2372	44f8528c9639dba967483ac5c3156a280c04e079afdd743a10a8ea4c3cb512d8.exe	28
PID 2372 wrote to memory of 1372	2372	44f8528c9639dba967483ac5c3156a280c04e079afdd743a10a8ea4c3cb512d8.exe	28

C:\Users\Admin\AppData\Local\Temp\44f8528c9639dba967483ac5c3156a280c04e079afdd743a10a8ea4c3cb512d8.exe
"C:\Users\Admin\AppData\Local\Temp\44f8528c9639dba967483ac5c3156a280c04e079afdd743a10a8ea4c3cb512d8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2372 -s 32
  2⤵
  PID:1372