2022419c3ebb28a926cc3fe58ad23a43e8da551de96fc016655263acd504479a

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 04:26

Target

DomaIQ.exe
Size

348KB
MD5

88a04aa034a16eeacec498c608614ba5
SHA1

bf9f1a17063ad536d2157005f06acdc89ac970fe
SHA256

d619dfe1c2211bbe5c2bc8d9f80192ab45355424ea7887e401edd723f154ca7b
SHA512

d226ec6115d51b15acfe837d4b6e3c3aa29b989ac793d56b6bfe61dc2ed68c323924f25b0c8f53d4dcc857ea54c3543b5b46ac15ec76311d8f374d8c57217076
SSDEEP

6144:Pz5L2CT0UjaI5ivEB3axg6UB2R+zv/t9IJyjonLOVRrXWEqFan:o0CEB3bk+zvjdq6n

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2604	2332	DomaIQ.exe	28
PID 2332 wrote to memory of 2604	2332	DomaIQ.exe	28
PID 2332 wrote to memory of 2604	2332	DomaIQ.exe	28

C:\Users\Admin\AppData\Local\Temp\DomaIQ.exe
"C:\Users\Admin\AppData\Local\Temp\DomaIQ.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2332 -s 676
  2⤵
  PID:2604

memory/2332-0-0x0000000000F40000-0x0000000000F9E000-memory.dmp

Filesize
376KB

Download
memory/2332-1-0x000007FEF6170000-0x000007FEF6B5C000-memory.dmp

Filesize
9.9MB

Download
memory/2332-2-0x000000001B1E0000-0x000000001B260000-memory.dmp

Filesize
512KB

Download
memory/2332-3-0x0000000000160000-0x0000000000170000-memory.dmp

Filesize
64KB

Download
memory/2332-4-0x000007FEF6170000-0x000007FEF6B5C000-memory.dmp

Filesize
9.9MB

Download
memory/2332-5-0x000000001B1E0000-0x000000001B260000-memory.dmp

Filesize
512KB

Download