0bcb3f8310fa777796da9bf501dbca4f64a183a6ec4066b9b164f09e8c8c2838

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 09:34

Target

DomaIQ.exe
Size

342KB
MD5

5e738ce64ecf55da1cd48802a7c71728
SHA1

8059044cb6db8138d4ce859d547f3edf44a5ae8a
SHA256

9cfcc4e9519052814724aef4a32d591690ebaa271a14b2d8e45d2857f035bec9
SHA512

89ec8a90f2f61de55ae88fdc79ab32e8a74fcfa0ac9f5757de0fcb4e5629ac5c43707304ce09ba41f4547b9882d505725a4f357c0a9b916421de6d300c2c30f9
SSDEEP

6144:bMxDCNU8UqzcgEoysbFKAw4OgmQi6Wudtw/AJu0LSpm:lW8UEcfFGhsQ7O/AJuJm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2368	3024	DomaIQ.exe	28
PID 3024 wrote to memory of 2368	3024	DomaIQ.exe	28
PID 3024 wrote to memory of 2368	3024	DomaIQ.exe	28

C:\Users\Admin\AppData\Local\Temp\DomaIQ.exe
"C:\Users\Admin\AppData\Local\Temp\DomaIQ.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3024 -s 672
  2⤵
  PID:2368

memory/3024-0-0x0000000000D70000-0x0000000000DCC000-memory.dmp

Filesize
368KB

Download
memory/3024-2-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

Filesize
9.9MB

Download
memory/3024-1-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/3024-3-0x000000001B100000-0x000000001B180000-memory.dmp

Filesize
512KB

Download
memory/3024-4-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

Filesize
9.9MB

Download
memory/3024-5-0x000000001B100000-0x000000001B180000-memory.dmp

Filesize
512KB

Download