7629dd894e38ade4f8616015fd785102050dc680656fafd86125860130b0014d

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 14:26

Target

b4eca82264aed7e495e2edf641cdb72f.exe
Size

6KB
MD5

b4eca82264aed7e495e2edf641cdb72f
SHA1

71df5e02e6beffb24d79afa293d08fc6ee777961
SHA256

7629dd894e38ade4f8616015fd785102050dc680656fafd86125860130b0014d
SHA512

67130488d86ccce0ef3ee293cdf4ab3bb960b34be0f664e065243bb07af20a076a6a7a7c12078feab0ce32bdd72442ae65fd7117fa0f772071c24833acea803d
SSDEEP

48:S6bt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9uOO:v0mIGnFc/38+N4ZHJWSY9FI5WqXx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2268	2772	b4eca82264aed7e495e2edf641cdb72f.exe	28
PID 2772 wrote to memory of 2268	2772	b4eca82264aed7e495e2edf641cdb72f.exe	28
PID 2772 wrote to memory of 2268	2772	b4eca82264aed7e495e2edf641cdb72f.exe	28

C:\Users\Admin\AppData\Local\Temp\b4eca82264aed7e495e2edf641cdb72f.exe
"C:\Users\Admin\AppData\Local\Temp\b4eca82264aed7e495e2edf641cdb72f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2772 -s 32
  2⤵
  PID:2268