eca093415edb4fb96334b58d7e8c4aae8f42280bf628d162444b299d812f709e

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/02/2024, 15:32

Target

eca093415edb4fb96334b58d7e8c4aae8f42280bf628d162444b299d812f709e.exe
Size

6KB
MD5

89254242fe3a095ac985cb6faebd1ddb
SHA1

087bdd848a46457b86edeede440e4d44921a2375
SHA256

eca093415edb4fb96334b58d7e8c4aae8f42280bf628d162444b299d812f709e
SHA512

df603c4f27ffc3978aaa22ff994a13dadba6be689630cc1b2ad4b52fc7c3556ef0a3f4c0143add56cdf1366f9e2e8e4265878005a16d5363cf2b6c7511377410
SSDEEP

48:Sh3bt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9uO:g0mIGnFc/38+N4ZHJWSY9FI5Wq4x

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1664	2000	eca093415edb4fb96334b58d7e8c4aae8f42280bf628d162444b299d812f709e.exe	28
PID 2000 wrote to memory of 1664	2000	eca093415edb4fb96334b58d7e8c4aae8f42280bf628d162444b299d812f709e.exe	28
PID 2000 wrote to memory of 1664	2000	eca093415edb4fb96334b58d7e8c4aae8f42280bf628d162444b299d812f709e.exe	28

C:\Users\Admin\AppData\Local\Temp\eca093415edb4fb96334b58d7e8c4aae8f42280bf628d162444b299d812f709e.exe
"C:\Users\Admin\AppData\Local\Temp\eca093415edb4fb96334b58d7e8c4aae8f42280bf628d162444b299d812f709e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2000 -s 32
  2⤵
  PID:1664