0eaffdfffeb1714c0245513d0ac306e4e345367569f1c65000711138c4ec5395

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-03-2024 07:42

Target

0eaffdfffeb1714c0245513d0ac306e4e345367569f1c65000711138c4ec5395.exe
Size

1.3MB
MD5

090d248ff4faeec10b7d428e2c0385b1
SHA1

460c0b85903edd32b32aa9ce6ccec0e342c8b645
SHA256

0eaffdfffeb1714c0245513d0ac306e4e345367569f1c65000711138c4ec5395
SHA512

e1b39fe3beb995ccd67613c9fdbaf9c15e588756343f86ea0e3e94254c81787b80302afbdb4e4b3106127e1e84e9b8544081786f7cc8f7a8c9301f43a7831d76
SSDEEP

24576:gUiy8fkHcLMXk36ZgZx+gR1QWrNbGjWvAhkF6bJ7kDS:JiPfkyMUqZwxVBFGjW4SsV7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2112	2208	0eaffdfffeb1714c0245513d0ac306e4e345367569f1c65000711138c4ec5395.exe	28
PID 2208 wrote to memory of 2112	2208	0eaffdfffeb1714c0245513d0ac306e4e345367569f1c65000711138c4ec5395.exe	28
PID 2208 wrote to memory of 2112	2208	0eaffdfffeb1714c0245513d0ac306e4e345367569f1c65000711138c4ec5395.exe	28

C:\Users\Admin\AppData\Local\Temp\0eaffdfffeb1714c0245513d0ac306e4e345367569f1c65000711138c4ec5395.exe
"C:\Users\Admin\AppData\Local\Temp\0eaffdfffeb1714c0245513d0ac306e4e345367569f1c65000711138c4ec5395.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2208 -s 144
  2⤵
  PID:2112