2c51f67e236cf95e2d51df4178699da09869ab077924cff0b3df1c512878ef2f

Analysis

max time kernel
14s
max time network
21s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 23:55

Target

Wave.exe
Size

7.0MB
MD5

a8bd4a6b2f1d00928e61870a5688c13d
SHA1

e17646d5279534f2e3eb0e0cfc8b6c536bc0c095
SHA256

2c51f67e236cf95e2d51df4178699da09869ab077924cff0b3df1c512878ef2f
SHA512

6b5175beea4071668c87b16af3177bbb2cbaff6b28909dc1e09ad5b16b449c62d6adc372a0094de627fe9835f0c474d16708c3f698355ba1664bf321fa19f5fb
SSDEEP

98304:37//YITF8r2n8TevxbFKVlXk34tZ+t4+aNG5Lhd+2G4Op0cN+hmdYkvsFLL:37//1xBVqvG5dQ2m0cN+hmdYkvsFLL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 2296	828	Wave.exe	28
PID 828 wrote to memory of 2296	828	Wave.exe	28
PID 828 wrote to memory of 2296	828	Wave.exe	28

C:\Users\Admin\AppData\Local\Temp\Wave.exe
"C:\Users\Admin\AppData\Local\Temp\Wave.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 828 -s 644
  2⤵
  PID:2296

memory/828-0-0x000000013FB40000-0x0000000140248000-memory.dmp

Filesize
7.0MB

Download
memory/828-1-0x000007FEF5720000-0x000007FEF610C000-memory.dmp

Filesize
9.9MB

Download
memory/828-2-0x000000001BCE0000-0x000000001BD60000-memory.dmp

Filesize
512KB

Download
memory/828-3-0x000007FEF5720000-0x000007FEF610C000-memory.dmp

Filesize
9.9MB

Download