f74fa898255d0f40f5481d3462e2d6a5afb4d38b55c21d14b09380ce086b1661

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 18:45

Target

c416f9935c340c6481793340382e1051.exe
Size

244KB
MD5

c416f9935c340c6481793340382e1051
SHA1

b4e765ac4275c088069f4f7f7d566efcd321b633
SHA256

f74fa898255d0f40f5481d3462e2d6a5afb4d38b55c21d14b09380ce086b1661
SHA512

e44ec47f189345e72d0b14e71c4636db0a7eb15d1ef25430bc3dd8318ed7fd684adbe2aedc6a3c2897ffb9e562666b990ebc6ece95aba2b1b52da26d8204480c
SSDEEP

3072:nVstD7trOt9pfslMYO9mXn9H0LeinObM6gZy5ChoTi1ikTbvpo8cA:Vw1rOt9pdYamXnrdbMKwvTbvpo8cA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2972	2548	c416f9935c340c6481793340382e1051.exe	28
PID 2548 wrote to memory of 2972	2548	c416f9935c340c6481793340382e1051.exe	28
PID 2548 wrote to memory of 2972	2548	c416f9935c340c6481793340382e1051.exe	28

C:\Users\Admin\AppData\Local\Temp\c416f9935c340c6481793340382e1051.exe
"C:\Users\Admin\AppData\Local\Temp\c416f9935c340c6481793340382e1051.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2548 -s 108
  2⤵
  PID:2972

memory/2548-0-0x0000000140000000-0x0000000140042000-memory.dmp

Filesize
264KB

Download
memory/2548-1-0x0000000140000000-0x0000000140042000-memory.dmp

Filesize
264KB

Download