992081394db3c667a130c26ce91dc374ada732d06d8b491d1336ab0124c8a2e3

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 16:57

Target

992081394db3c667a130c26ce91dc374ada732d06d8b491d1336ab0124c8a2e3.exe
Size

6KB
MD5

260c3838954af08ac75cd1511a1ebe2b
SHA1

875b03571abe921053ff383f6543b058d13c7535
SHA256

992081394db3c667a130c26ce91dc374ada732d06d8b491d1336ab0124c8a2e3
SHA512

0f009d02d04d11f12b29943429f3e1a91bcaafbc1a0758598467113e23bf7b2494df41b891c6fdaec619c1129d88ecb8c7dffb5d1677fd48899698b09efa5810
SSDEEP

48:SMbt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9uGO:F0mIGnFc/38+N4ZHJWSY9FI5Wqfx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2832	1688	992081394db3c667a130c26ce91dc374ada732d06d8b491d1336ab0124c8a2e3.exe	28
PID 1688 wrote to memory of 2832	1688	992081394db3c667a130c26ce91dc374ada732d06d8b491d1336ab0124c8a2e3.exe	28
PID 1688 wrote to memory of 2832	1688	992081394db3c667a130c26ce91dc374ada732d06d8b491d1336ab0124c8a2e3.exe	28

C:\Users\Admin\AppData\Local\Temp\992081394db3c667a130c26ce91dc374ada732d06d8b491d1336ab0124c8a2e3.exe
"C:\Users\Admin\AppData\Local\Temp\992081394db3c667a130c26ce91dc374ada732d06d8b491d1336ab0124c8a2e3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1688 -s 32
  2⤵
  PID:2832