4ce210ed888ef0799aade75a3764c2c4186efc4923be5e9860ccdb3d346a4114

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/03/2024, 02:13

Target

4ce210ed888ef0799aade75a3764c2c4186efc4923be5e9860ccdb3d346a4114.exe
Size

322KB
MD5

bc67a3d548db497abf18c6aca4ce03d9
SHA1

8ac17755f15a423082200acb8961f5ce9454e90f
SHA256

4ce210ed888ef0799aade75a3764c2c4186efc4923be5e9860ccdb3d346a4114
SHA512

65d2c6375dc6ca6615822a52699c931637cdcaed872e97b4e8fa936d935254ca6fa1b348a3fe0bb98b11f14ed07511c4ce8e2a719260b863db55b67ee21cc2fa
SSDEEP

3072:1zg7+az9h5ajKOOq5ffffxffgREeffffs9ffZ8fff1iefffffzAYay6RPTudffZb:+7+az9SvVtYaRm8tpP0mnZDNP6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2592	2172	4ce210ed888ef0799aade75a3764c2c4186efc4923be5e9860ccdb3d346a4114.exe	30
PID 2172 wrote to memory of 2592	2172	4ce210ed888ef0799aade75a3764c2c4186efc4923be5e9860ccdb3d346a4114.exe	30
PID 2172 wrote to memory of 2592	2172	4ce210ed888ef0799aade75a3764c2c4186efc4923be5e9860ccdb3d346a4114.exe	30

C:\Users\Admin\AppData\Local\Temp\4ce210ed888ef0799aade75a3764c2c4186efc4923be5e9860ccdb3d346a4114.exe
"C:\Users\Admin\AppData\Local\Temp\4ce210ed888ef0799aade75a3764c2c4186efc4923be5e9860ccdb3d346a4114.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2172 -s 48
  2⤵
  PID:2592

memory/2172-0-0x000000013F3F0000-0x000000013F44B000-memory.dmp

Filesize
364KB

Download