1cbf582e2373ae4d763d3aec85107170658fc1ee11ee2e0f92995fb3df1f8e38

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 02:00

Target

1cbf582e2373ae4d763d3aec85107170658fc1ee11ee2e0f92995fb3df1f8e38.exe
Size

89KB
MD5

50f94c38afce367dd0d2fb4f19226809
SHA1

fb7606bb2a783ad57a91adb7ee3ceee265e8ced1
SHA256

1cbf582e2373ae4d763d3aec85107170658fc1ee11ee2e0f92995fb3df1f8e38
SHA512

5e2290a3073cd9242de8182a605d635ad568c62b8a81ff08e32edf000050a19a6029e7ccc94073469e28df1b8ff16473da894d4c57229220c5fb1d188fe693de
SSDEEP

1536:b6K0lmk92xYvOl6w2K3z5NeVpke07YbCPmcg6ZH7qfLcb3Z6dHYD7rIenvviyIe4:erEavuD/wkOCP5g6Zb+Q3Z6dHYD7rBvU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 1248	2152	1cbf582e2373ae4d763d3aec85107170658fc1ee11ee2e0f92995fb3df1f8e38.exe	29
PID 2152 wrote to memory of 1248	2152	1cbf582e2373ae4d763d3aec85107170658fc1ee11ee2e0f92995fb3df1f8e38.exe	29
PID 2152 wrote to memory of 1248	2152	1cbf582e2373ae4d763d3aec85107170658fc1ee11ee2e0f92995fb3df1f8e38.exe	29

C:\Users\Admin\AppData\Local\Temp\1cbf582e2373ae4d763d3aec85107170658fc1ee11ee2e0f92995fb3df1f8e38.exe
"C:\Users\Admin\AppData\Local\Temp\1cbf582e2373ae4d763d3aec85107170658fc1ee11ee2e0f92995fb3df1f8e38.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2152 -s 520
  2⤵
  PID:1248

memory/2152-0-0x0000000001130000-0x000000000114C000-memory.dmp

Filesize
112KB

Download
memory/2152-1-0x000007FEF5950000-0x000007FEF633C000-memory.dmp

Filesize
9.9MB

Download
memory/2152-2-0x000007FEF5950000-0x000007FEF633C000-memory.dmp

Filesize
9.9MB

Download