f67af6c7fb206a45a62287aa0a0b29713655a181fc9bab894f2331b89627dafc

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 22:14

Target

f67af6c7fb206a45a62287aa0a0b29713655a181fc9bab894f2331b89627dafc.exe
Size

6KB
MD5

28e5ddae1f670b86ba2509f8348671bd
SHA1

571c8104a7096d36cd8a5a56da60fe257e3f5bcd
SHA256

f67af6c7fb206a45a62287aa0a0b29713655a181fc9bab894f2331b89627dafc
SHA512

e184d053c9b8cbdf33523d0d3834d3863505f2bd40321f4ad7611e88dcb45408d0a5a48643d20474160c04a9b234310f5ecc98151118fdf1c9d9faa81ae7154f
SSDEEP

48:SVbt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9uOO:s0mIGnFc/38+N4ZHJWSY9FI5Wq3x

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

f67af6c7fb206a45a62287aa0a0b29713655a181fc9bab894f2331b89627dafc.exe

description	pid	process	target process
PID 1948 wrote to memory of 2824	1948	f67af6c7fb206a45a62287aa0a0b29713655a181fc9bab894f2331b89627dafc.exe	WerFault.exe
PID 1948 wrote to memory of 2824	1948	f67af6c7fb206a45a62287aa0a0b29713655a181fc9bab894f2331b89627dafc.exe	WerFault.exe
PID 1948 wrote to memory of 2824	1948	f67af6c7fb206a45a62287aa0a0b29713655a181fc9bab894f2331b89627dafc.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f67af6c7fb206a45a62287aa0a0b29713655a181fc9bab894f2331b89627dafc.exe
"C:\Users\Admin\AppData\Local\Temp\f67af6c7fb206a45a62287aa0a0b29713655a181fc9bab894f2331b89627dafc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1948 -s 32
2⤵
PID:2824