3849a8c894b1930330677e1a4ab79804fa923e9829333f49e76a954173bffd0c

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 02:32

Target

3849a8c894b1930330677e1a4ab79804fa923e9829333f49e76a954173bffd0c.exe
Size

6KB
MD5

37ecfaf86e7a4ef5a535ea7a0c4b755a
SHA1

f350fef7ed0cdcd1cd6081e52c874a7bdc1561ce
SHA256

3849a8c894b1930330677e1a4ab79804fa923e9829333f49e76a954173bffd0c
SHA512

3142bfd8171f47926f92e7af1f27fa41fbcd4c700dfa3fb5c2874a3ab71c37498d3438865cd0f78d1b910b81b8c95acf7948f3298c792fed12a520a95ad00927
SSDEEP

48:SWbt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9uTQ:70mIGnFc/38+N4ZHJWSY9FI5Wqux

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2056	2492	3849a8c894b1930330677e1a4ab79804fa923e9829333f49e76a954173bffd0c.exe	28
PID 2492 wrote to memory of 2056	2492	3849a8c894b1930330677e1a4ab79804fa923e9829333f49e76a954173bffd0c.exe	28
PID 2492 wrote to memory of 2056	2492	3849a8c894b1930330677e1a4ab79804fa923e9829333f49e76a954173bffd0c.exe	28

C:\Users\Admin\AppData\Local\Temp\3849a8c894b1930330677e1a4ab79804fa923e9829333f49e76a954173bffd0c.exe
"C:\Users\Admin\AppData\Local\Temp\3849a8c894b1930330677e1a4ab79804fa923e9829333f49e76a954173bffd0c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2492 -s 32
  2⤵
  PID:2056