a217174970eb9a86ee9efbe6acdc3bfcaf67e956b2bee99589b07021a8d34aeb

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 18:22

Target

a217174970eb9a86ee9efbe6acdc3bfcaf67e956b2bee99589b07021a8d34aeb.exe
Size

1.4MB
MD5

5683c85e8ae985e8e8f7d219d7e2a019
SHA1

54668386caa17131d10999703ee18d8ef7072073
SHA256

a217174970eb9a86ee9efbe6acdc3bfcaf67e956b2bee99589b07021a8d34aeb
SHA512

edce02359a1347a6383f97dae9c0406148734f3b81852f6f6f788bac80d414bcfbde10b8bb5587f1589e3abad409db48c4b2bc46fd0f96d8358b7f2a935ab27c
SSDEEP

24576:4tFS4j1cVPdZ8bBHeNxfMCrMhvHyZkno8DSdAqKWbJ7:ariVabB+NeCANRofV7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a217174970eb9a86ee9efbe6acdc3bfcaf67e956b2bee99589b07021a8d34aeb.exe

description	pid	process	target process
PID 1648 wrote to memory of 2148	1648	a217174970eb9a86ee9efbe6acdc3bfcaf67e956b2bee99589b07021a8d34aeb.exe	WerFault.exe
PID 1648 wrote to memory of 2148	1648	a217174970eb9a86ee9efbe6acdc3bfcaf67e956b2bee99589b07021a8d34aeb.exe	WerFault.exe
PID 1648 wrote to memory of 2148	1648	a217174970eb9a86ee9efbe6acdc3bfcaf67e956b2bee99589b07021a8d34aeb.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a217174970eb9a86ee9efbe6acdc3bfcaf67e956b2bee99589b07021a8d34aeb.exe
"C:\Users\Admin\AppData\Local\Temp\a217174970eb9a86ee9efbe6acdc3bfcaf67e956b2bee99589b07021a8d34aeb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1648 -s 144
  2⤵
  PID:2148