4d74f3d799fda9774529a2f5d684aa6a286b6f38fccb15e18df355276c555a15

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 11:46

Target

4d74f3d799fda9774529a2f5d684aa6a286b6f38fccb15e18df355276c555a15.exe
Size

6KB
MD5

57deb595fb3bf7cd99d2fd64a81117b6
SHA1

de9c3100d3fae1d7ae5b2363394f04afd82c4257
SHA256

4d74f3d799fda9774529a2f5d684aa6a286b6f38fccb15e18df355276c555a15
SHA512

b2c318103f419e2bd92f7eac81963e289f02a6fce24bcca5e9853ef79175e9261a68d6db36652ee3b043ec38f999d1452da4e9047376e717e5ef4f2d4cfb35c1
SSDEEP

48:Sybt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9u+O:z0mIGnFc/38+N4ZHJWSY9FI5WqHx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2164	3064	4d74f3d799fda9774529a2f5d684aa6a286b6f38fccb15e18df355276c555a15.exe	29
PID 3064 wrote to memory of 2164	3064	4d74f3d799fda9774529a2f5d684aa6a286b6f38fccb15e18df355276c555a15.exe	29
PID 3064 wrote to memory of 2164	3064	4d74f3d799fda9774529a2f5d684aa6a286b6f38fccb15e18df355276c555a15.exe	29

C:\Users\Admin\AppData\Local\Temp\4d74f3d799fda9774529a2f5d684aa6a286b6f38fccb15e18df355276c555a15.exe
"C:\Users\Admin\AppData\Local\Temp\4d74f3d799fda9774529a2f5d684aa6a286b6f38fccb15e18df355276c555a15.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3064 -s 32
  2⤵
  PID:2164