d31082459abbdc5ee8891781dcf787762a3546883ff0c1bf53e602dc74224506

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-03-2024 02:26

Target

d31082459abbdc5ee8891781dcf787762a3546883ff0c1bf53e602dc74224506.exe
Size

52KB
MD5

a358d6149bf0db6e9fe1dd4be02220d0
SHA1

e263f4c09574775d747d2d5999f57283161e886d
SHA256

d31082459abbdc5ee8891781dcf787762a3546883ff0c1bf53e602dc74224506
SHA512

4fb7dcfc5c65fe0da0adfc39fa5f459f70099e53f7e59d46e46b580a7056b21e499ccde59a61cbafda01d8773842accb56fa0a9a77faafcf540bafc44dc85c1c
SSDEEP

1536:ix8XUF0PzNrjf0PwDzMifhFjpifnGMoJULJHumB5n:ix8XUF0PzNvf0PwDgif3pifnGMsWJOm7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2728	2220	d31082459abbdc5ee8891781dcf787762a3546883ff0c1bf53e602dc74224506.exe	28
PID 2220 wrote to memory of 2728	2220	d31082459abbdc5ee8891781dcf787762a3546883ff0c1bf53e602dc74224506.exe	28
PID 2220 wrote to memory of 2728	2220	d31082459abbdc5ee8891781dcf787762a3546883ff0c1bf53e602dc74224506.exe	28

C:\Users\Admin\AppData\Local\Temp\d31082459abbdc5ee8891781dcf787762a3546883ff0c1bf53e602dc74224506.exe
"C:\Users\Admin\AppData\Local\Temp\d31082459abbdc5ee8891781dcf787762a3546883ff0c1bf53e602dc74224506.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2220 -s 712
  2⤵
  PID:2728

memory/2220-0-0x0000000000A90000-0x0000000000AA4000-memory.dmp

Filesize
80KB

Download
memory/2220-1-0x000007FEF5390000-0x000007FEF5D7C000-memory.dmp

Filesize
9.9MB

Download
memory/2220-2-0x000000001B310000-0x000000001B390000-memory.dmp

Filesize
512KB

Download
memory/2220-3-0x000007FEF5390000-0x000007FEF5D7C000-memory.dmp

Filesize
9.9MB

Download
memory/2220-4-0x000000001B310000-0x000000001B390000-memory.dmp

Filesize
512KB

Download