3cf0b82b4b91ac001ede7dfe7736f42e2a5e1bd9cc6da34393ec9e18ec81a9fe

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 01:01

Target

3cf0b82b4b91ac001ede7dfe7736f42e2a5e1bd9cc6da34393ec9e18ec81a9fe.exe
Size

45KB
MD5

e533f92146fcacb8caca823882b8d304
SHA1

fcb2b79d08e2fb7a58142faf7db2a36f142b309d
SHA256

3cf0b82b4b91ac001ede7dfe7736f42e2a5e1bd9cc6da34393ec9e18ec81a9fe
SHA512

334b90d543b5835f88d3891c03fe78ac91c2569e47bfb11fbae58b9544fa569f411e4a2d8b57049a97f79afd51312eed57dd95c74b680331882ca77a46888c69
SSDEEP

768:ygDUz4vSd32TINlRjiniKEc3dJ3Bwj+3p5SNUMNTEFiRQ:zUz4Kd320N+nir2FMN9NeiS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2120	812	3cf0b82b4b91ac001ede7dfe7736f42e2a5e1bd9cc6da34393ec9e18ec81a9fe.exe	28
PID 812 wrote to memory of 2120	812	3cf0b82b4b91ac001ede7dfe7736f42e2a5e1bd9cc6da34393ec9e18ec81a9fe.exe	28
PID 812 wrote to memory of 2120	812	3cf0b82b4b91ac001ede7dfe7736f42e2a5e1bd9cc6da34393ec9e18ec81a9fe.exe	28

C:\Users\Admin\AppData\Local\Temp\3cf0b82b4b91ac001ede7dfe7736f42e2a5e1bd9cc6da34393ec9e18ec81a9fe.exe
"C:\Users\Admin\AppData\Local\Temp\3cf0b82b4b91ac001ede7dfe7736f42e2a5e1bd9cc6da34393ec9e18ec81a9fe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 812 -s 628
  2⤵
  PID:2120

memory/812-0-0x0000000000840000-0x000000000084E000-memory.dmp

Filesize
56KB

Download
memory/812-1-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/812-2-0x000000001B340000-0x000000001B3C0000-memory.dmp

Filesize
512KB

Download
memory/812-3-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/812-4-0x000000001B340000-0x000000001B3C0000-memory.dmp

Filesize
512KB

Download