e17f651dbe0f97554adfacbc2ccc5797ebd41d61e3174b7ab825d8d37a114397

Analysis

max time kernel
24s
max time network
19s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-03-2024 07:20

Target

Tool/Avatar Tools/ref/Avatar PSN Tools.exe
Size

7KB
MD5

84865470ecc1b1d3922d8e6619ac0912
SHA1

0d45e0cc8453d27384c10928a743299e6fadec37
SHA256

db487e1f264f4d3ff983b79e6fd5dc22b1a567a6865ae9f557e075350bf8169f
SHA512

4da8b3e671e080c515eb0b08161dbb8729a96b277473d3c033d5002490f0f66d001ecb3771ae0431efa8b942f8a588c7d3bf3f9d804de7fe50c198cb096bf2c9
SSDEEP

96:wsEIYyvvmJO1gAktFrXPwLNnizJrFIdnlhXupzSiT8xixuVxKwxxYxOzNt:aI3mJOSAktFrXPKN+J+dLvg6fx6m

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Avatar PSN Tools.exe

description	pid	process	target process
PID 2848 wrote to memory of 2840	2848	Avatar PSN Tools.exe	WerFault.exe
PID 2848 wrote to memory of 2840	2848	Avatar PSN Tools.exe	WerFault.exe
PID 2848 wrote to memory of 2840	2848	Avatar PSN Tools.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Tool\Avatar Tools\ref\Avatar PSN Tools.exe
"C:\Users\Admin\AppData\Local\Temp\Tool\Avatar Tools\ref\Avatar PSN Tools.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2848

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2848 -s 480
2⤵
PID:2840

memory/2848-0-0x0000000000F30000-0x0000000000F3A000-memory.dmp

Filesize
40KB

Download
memory/2848-1-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

Filesize
9.9MB

Download
memory/2848-2-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

Filesize
9.9MB

Download