9f5c8e3fd7b8cdbed4133f656c592fd898e906acb9a83a9d5c76b5dd582258bf

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 00:49

Target

9f5c8e3fd7b8cdbed4133f656c592fd898e906acb9a83a9d5c76b5dd582258bf.exe
Size

671KB
MD5

88df57bba5d5347e1e29ffb9004813cf
SHA1

363c02321a49bb51e42e5aa4de94724beb8c87f2
SHA256

9f5c8e3fd7b8cdbed4133f656c592fd898e906acb9a83a9d5c76b5dd582258bf
SHA512

509c3bae33185b5118b02574b583b8d1407f291a5dadf62508548e14d741befeeb7b4f02efa218b100c6767c56f8ef4ebd7bd6c9baeaa743278c86933e91cd6e
SSDEEP

12288:cPdtMAVeEWQEwVDp2Mk72VtysQHh1dnDt/ExTEllyItkc47tsC1XoRSED1mDgOED:cPdtMAVeEWQEwVDp2Mk72VtysQHh1dnl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2904	3028	9f5c8e3fd7b8cdbed4133f656c592fd898e906acb9a83a9d5c76b5dd582258bf.exe	28
PID 3028 wrote to memory of 2904	3028	9f5c8e3fd7b8cdbed4133f656c592fd898e906acb9a83a9d5c76b5dd582258bf.exe	28
PID 3028 wrote to memory of 2904	3028	9f5c8e3fd7b8cdbed4133f656c592fd898e906acb9a83a9d5c76b5dd582258bf.exe	28

C:\Users\Admin\AppData\Local\Temp\9f5c8e3fd7b8cdbed4133f656c592fd898e906acb9a83a9d5c76b5dd582258bf.exe
"C:\Users\Admin\AppData\Local\Temp\9f5c8e3fd7b8cdbed4133f656c592fd898e906acb9a83a9d5c76b5dd582258bf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3028 -s 536
  2⤵
  PID:2904

memory/3028-0-0x0000000000980000-0x0000000000A2E000-memory.dmp

Filesize
696KB

Download
memory/3028-1-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

Filesize
9.9MB

Download
memory/3028-2-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

Filesize
9.9MB

Download