82eec4f0827f06f6ccae960adcd22996ef727e1b760543e0db734446f4e14783

Analysis

max time kernel
35s
max time network
16s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 21:07

Target

82eec4f0827f06f6ccae960adcd22996ef727e1b760543e0db734446f4e14783.exe
Size

25KB
MD5

fd62b3909a823868bbdafc0a32f2fff0
SHA1

65b4f76d678821bbff0901b97bb4de2c70876b11
SHA256

82eec4f0827f06f6ccae960adcd22996ef727e1b760543e0db734446f4e14783
SHA512

97c4bd721c82230363515eda403e60dc4d9bade9b6bf44fbdc059fa03e5ef653dcf4573d6b31b00f4db8419e04d33ba670f743b7624772fbec9bf9b6078b2fe7
SSDEEP

768:FEHP8T/2LzFiAEWM41v18bVk0gm3HrdQ:FEHP8TyP4a0X3m

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2988	1876	82eec4f0827f06f6ccae960adcd22996ef727e1b760543e0db734446f4e14783.exe	29
PID 1876 wrote to memory of 2988	1876	82eec4f0827f06f6ccae960adcd22996ef727e1b760543e0db734446f4e14783.exe	29
PID 1876 wrote to memory of 2988	1876	82eec4f0827f06f6ccae960adcd22996ef727e1b760543e0db734446f4e14783.exe	29

C:\Users\Admin\AppData\Local\Temp\82eec4f0827f06f6ccae960adcd22996ef727e1b760543e0db734446f4e14783.exe
"C:\Users\Admin\AppData\Local\Temp\82eec4f0827f06f6ccae960adcd22996ef727e1b760543e0db734446f4e14783.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1876 -s 536
  2⤵
  PID:2988

memory/1876-0-0x0000000000360000-0x000000000036C000-memory.dmp

Filesize
48KB

Download
memory/1876-1-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download
memory/1876-2-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download
memory/1876-3-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download