e9007c7bd6be14d6364b91e1fd7b03043dffe8a405eca5cc6dc809762bd31ba2

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 09:49

Target
VERIFICATION.EXE.exe
Size 731KB
Sample240501-ltc13aec44
SHA256 e9007c7bd6be14d6364b91e1fd7b03043dffe8a405eca5cc6dc809762bd31ba2
MD5 d74cf6a901a529abb68a9c0fbbc1034b
SHA1 fbd6b5c70e3c099f49aa91a229fad0cd4e1b4bfc
SHA512 41754b1a042e0f955c02e059d9e5cbb57cde7dddf51a05a80444b750c6596fb90a07eb00d4d6292aa52539b2df58bd6b1712dd5434fb753db5e8e3b2052d47a6
SSDEEP 6144:Fp19SmYRZbsuSBs3ojpe6aABlwZFsr5pOGJr3eRqk3tJc+xZRtiKzvzaOKIeM87h:Fp1EPZbsu2s3ojpe6aeSg3DeRqkUWu
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1636	1620	VERIFICATION.EXE.exe	28
PID 1620 wrote to memory of 1636	1620	VERIFICATION.EXE.exe	28
PID 1620 wrote to memory of 1636	1620	VERIFICATION.EXE.exe	28

C:\Users\Admin\AppData\Local\Temp\VERIFICATION.EXE.exe
"C:\Users\Admin\AppData\Local\Temp\VERIFICATION.EXE.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1620 -s 76
  2⤵
  PID:1636