81f95bd08d2ebeceab9f35fe519a236157bfe63203bf1754bbedb28d7e4cf5cf

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 01:07

Target

81f95bd08d2ebeceab9f35fe519a236157bfe63203bf1754bbedb28d7e4cf5cf.exe
Size

13KB
MD5

0abec3f1dff995eb48950dbdb0a0fa45
SHA1

48c422e279a9a262d8c6d1b463c06f5d861a6cd4
SHA256

81f95bd08d2ebeceab9f35fe519a236157bfe63203bf1754bbedb28d7e4cf5cf
SHA512

ff34d7a55faebdb445b0f2da8fb405f3a137f4c0c2864506c33fba72891136f81defae8204b9ebb7355c533e5534ea07d563d6e1494bf89a21abc177ec3544a5
SSDEEP

192:CBnJ+CdOyxA/22vwsaWUXk3XlMwGBaDns0TzTZbKrNPDN4:CBJ+CQSA/22Izp03XlHGBIh9utDN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2832	2096	81f95bd08d2ebeceab9f35fe519a236157bfe63203bf1754bbedb28d7e4cf5cf.exe	28
PID 2096 wrote to memory of 2832	2096	81f95bd08d2ebeceab9f35fe519a236157bfe63203bf1754bbedb28d7e4cf5cf.exe	28
PID 2096 wrote to memory of 2832	2096	81f95bd08d2ebeceab9f35fe519a236157bfe63203bf1754bbedb28d7e4cf5cf.exe	28

C:\Users\Admin\AppData\Local\Temp\81f95bd08d2ebeceab9f35fe519a236157bfe63203bf1754bbedb28d7e4cf5cf.exe
"C:\Users\Admin\AppData\Local\Temp\81f95bd08d2ebeceab9f35fe519a236157bfe63203bf1754bbedb28d7e4cf5cf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2096 -s 608
  2⤵
  PID:2832

memory/2096-0-0x0000000000CE0000-0x0000000000CEA000-memory.dmp

Filesize
40KB

Download
memory/2096-1-0x000007FEF5700000-0x000007FEF60EC000-memory.dmp

Filesize
9.9MB

Download
memory/2096-2-0x0000000000600000-0x0000000000680000-memory.dmp

Filesize
512KB

Download
memory/2096-3-0x000007FEF5700000-0x000007FEF60EC000-memory.dmp

Filesize
9.9MB

Download