bac1790efe7618c5b2b9e34e6e1d36ec51592869bcc5fb304dd7554c32731093

Analysis

max time kernel
183s
max time network
213s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 13:50

Target

bac1790efe7618c5b2b9e34e6e1d36ec51592869bcc5fb304dd7554c32731093.exe
Size

711KB
MD5

4e43c0ca1feebc1c7107a8ebb53255b9
SHA1

4598321f83bea18dd42cccb018081e0d6c483e82
SHA256

bac1790efe7618c5b2b9e34e6e1d36ec51592869bcc5fb304dd7554c32731093
SHA512

3bde9fa716c1e2c099c14a4c2f1728ba1aed35901f07acb99c4483d45b66a08ed706facedc14bfc0b2abf5321224b79d0f6c4ab7c4337e396342e5604d62d26a
SSDEEP

12288:7AiZYbHr5MpP8yelN+UItFbiyHiQht0R6v8ucIzmeY2TKjw0JdDNgjzE/vDRao:7AG6HdMpqNEO6v8ucIz1Y2GFdbjc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2764	2792	bac1790efe7618c5b2b9e34e6e1d36ec51592869bcc5fb304dd7554c32731093.exe	29
PID 2792 wrote to memory of 2764	2792	bac1790efe7618c5b2b9e34e6e1d36ec51592869bcc5fb304dd7554c32731093.exe	29
PID 2792 wrote to memory of 2764	2792	bac1790efe7618c5b2b9e34e6e1d36ec51592869bcc5fb304dd7554c32731093.exe	29

C:\Users\Admin\AppData\Local\Temp\bac1790efe7618c5b2b9e34e6e1d36ec51592869bcc5fb304dd7554c32731093.exe
"C:\Users\Admin\AppData\Local\Temp\bac1790efe7618c5b2b9e34e6e1d36ec51592869bcc5fb304dd7554c32731093.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2792 -s 188
  2⤵
  PID:2764