f6686ff7fb21893957ab9669faa06b6c9bcdbd4e2b9f8a70cb49cf2c67a21d7b

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 18:58

Target

f6686ff7fb21893957ab9669faa06b6c9bcdbd4e2b9f8a70cb49cf2c67a21d7b.exe
Size

617KB
MD5

99dd8196088ad3863b5d8d52068b45ed
SHA1

589babf3418b283d78fb90cf1426638aa1ecb91d
SHA256

f6686ff7fb21893957ab9669faa06b6c9bcdbd4e2b9f8a70cb49cf2c67a21d7b
SHA512

fc949bce43227f8d8a52999dc7c1a08aa27a7c0180435a619a0cdd31fb1e07eff72d4adf97556da336f38e640719aaca7540073bb29bd5f116449e3f45d5ac82
SSDEEP

12288:4XKPevQnXHhXHbXHKXH8xjLrRLn8sXH4XHLXHC:QK2vWXhXbXKXavF9X4XLXC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2872	2236	f6686ff7fb21893957ab9669faa06b6c9bcdbd4e2b9f8a70cb49cf2c67a21d7b.exe	27
PID 2236 wrote to memory of 2872	2236	f6686ff7fb21893957ab9669faa06b6c9bcdbd4e2b9f8a70cb49cf2c67a21d7b.exe	27
PID 2236 wrote to memory of 2872	2236	f6686ff7fb21893957ab9669faa06b6c9bcdbd4e2b9f8a70cb49cf2c67a21d7b.exe	27

C:\Users\Admin\AppData\Local\Temp\f6686ff7fb21893957ab9669faa06b6c9bcdbd4e2b9f8a70cb49cf2c67a21d7b.exe
"C:\Users\Admin\AppData\Local\Temp\f6686ff7fb21893957ab9669faa06b6c9bcdbd4e2b9f8a70cb49cf2c67a21d7b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2236 -s 612
  2⤵
  PID:2872

memory/2236-0-0x000000013FAA0000-0x000000013FB3E000-memory.dmp

Filesize
632KB

Download
memory/2236-1-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp

Filesize
9.9MB

Download
memory/2236-2-0x000000001BCA0000-0x000000001BD20000-memory.dmp

Filesize
512KB

Download
memory/2236-3-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp

Filesize
9.9MB

Download
memory/2236-4-0x000000001BCA0000-0x000000001BD20000-memory.dmp

Filesize
512KB

Download