6a831f7496b36c5a22c23dbc325e1eee1c2c93086345fc424ba8da21a1f05f19

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 01:29

Target

6a831f7496b36c5a22c23dbc325e1eee1c2c93086345fc424ba8da21a1f05f19.exe
Size

6KB
MD5

af5143c0a6b43f5e2cf0b9da4dd888be
SHA1

4dfda3af79909d690d9ed82e207bce630d2ef812
SHA256

6a831f7496b36c5a22c23dbc325e1eee1c2c93086345fc424ba8da21a1f05f19
SHA512

6e78dd7cd4d778fecb7fe75ef5311fdd92320cfe9a0f15383848fec2ee2d49e5f20ba9299da5b290e27b9d5345be4c6e59d5f491ab266c3d373ea29cd36dcde5
SSDEEP

96:/txxEsA2o6ur6VDsaVeoLCZ5OKDCbqYubuYuoM8frBbr7r9i/r2zNt:Vx6sAIur6WaVjL6bDCbqNSNQfVb3Q/c

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1632	948	6a831f7496b36c5a22c23dbc325e1eee1c2c93086345fc424ba8da21a1f05f19.exe	29
PID 948 wrote to memory of 1632	948	6a831f7496b36c5a22c23dbc325e1eee1c2c93086345fc424ba8da21a1f05f19.exe	29
PID 948 wrote to memory of 1632	948	6a831f7496b36c5a22c23dbc325e1eee1c2c93086345fc424ba8da21a1f05f19.exe	29

C:\Users\Admin\AppData\Local\Temp\6a831f7496b36c5a22c23dbc325e1eee1c2c93086345fc424ba8da21a1f05f19.exe
"C:\Users\Admin\AppData\Local\Temp\6a831f7496b36c5a22c23dbc325e1eee1c2c93086345fc424ba8da21a1f05f19.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 948 -s 496
  2⤵
  PID:1632

memory/948-0-0x00000000011A0000-0x00000000011A6000-memory.dmp

Filesize
24KB

Download
memory/948-1-0x000007FEF6030000-0x000007FEF6A1C000-memory.dmp

Filesize
9.9MB

Download
memory/948-2-0x000007FEF6030000-0x000007FEF6A1C000-memory.dmp

Filesize
9.9MB

Download