bfe65d31a1730c3061b4b8b6875478020148d7c55a596897766930576b70252e

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 01:21

Target

bfe65d31a1730c3061b4b8b6875478020148d7c55a596897766930576b70252e.exe
Size

165KB
MD5

b26484c90d9460c6dc04c34f8f263eb6
SHA1

25edac805a4fc9510287c50e39e23f27be3f1bd8
SHA256

bfe65d31a1730c3061b4b8b6875478020148d7c55a596897766930576b70252e
SHA512

d0dc647365508ca07c97b8e2d7fdf3df5fc76c253a195eee2466f4be780f2731c6bba99a69aa37779d08afaba8110c3f57787277292558385952b364e228b749
SSDEEP

1536:26jc+RGmjYpnp9Obzuc1vPW5sj1XU9PPhyzkhl8rNZm2n9bzwTveyM2eSX3o2R4G:dXKkITuwR8eNCCX98pyVTug

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2516	2192	bfe65d31a1730c3061b4b8b6875478020148d7c55a596897766930576b70252e.exe	28
PID 2192 wrote to memory of 2516	2192	bfe65d31a1730c3061b4b8b6875478020148d7c55a596897766930576b70252e.exe	28
PID 2192 wrote to memory of 2516	2192	bfe65d31a1730c3061b4b8b6875478020148d7c55a596897766930576b70252e.exe	28

C:\Users\Admin\AppData\Local\Temp\bfe65d31a1730c3061b4b8b6875478020148d7c55a596897766930576b70252e.exe
"C:\Users\Admin\AppData\Local\Temp\bfe65d31a1730c3061b4b8b6875478020148d7c55a596897766930576b70252e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2192 -s 536
  2⤵
  PID:2516

memory/2192-0-0x0000000000E30000-0x0000000000E5E000-memory.dmp

Filesize
184KB

Download
memory/2192-1-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Filesize
9.9MB

Download
memory/2192-2-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Filesize
9.9MB

Download