532fd0fa5915621b867fb91edbe610b6f336e97923543d960caec99f0268b34d

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 21:48

Target

532fd0fa5915621b867fb91edbe610b6f336e97923543d960caec99f0268b34d.exe
Size

1.4MB
MD5

505db6974da79082a75943a72704dd15
SHA1

797707b6f11c900ade436f88bbe5563e727b489e
SHA256

532fd0fa5915621b867fb91edbe610b6f336e97923543d960caec99f0268b34d
SHA512

fec83530f3497150119c0e88bc6615881336d4d6bb8297290d21247154771be000245913cbc13e00ad631fa7035b807b1cf9191ee96bc23ba90858d045332db7
SSDEEP

24576:zq+qw5o3uiu14D8gKgMAFu4iCk+9od36dNfKSuwlWw4vW6G4K:FvOUxgVMBNvUod3uNfKSuwlrc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 280	2984	532fd0fa5915621b867fb91edbe610b6f336e97923543d960caec99f0268b34d.exe	28
PID 2984 wrote to memory of 280	2984	532fd0fa5915621b867fb91edbe610b6f336e97923543d960caec99f0268b34d.exe	28
PID 2984 wrote to memory of 280	2984	532fd0fa5915621b867fb91edbe610b6f336e97923543d960caec99f0268b34d.exe	28

C:\Users\Admin\AppData\Local\Temp\532fd0fa5915621b867fb91edbe610b6f336e97923543d960caec99f0268b34d.exe
"C:\Users\Admin\AppData\Local\Temp\532fd0fa5915621b867fb91edbe610b6f336e97923543d960caec99f0268b34d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2984 -s 532
  2⤵
  PID:280

memory/2984-0-0x000007FEF5A73000-0x000007FEF5A74000-memory.dmp

Filesize
4KB

Download
memory/2984-1-0x00000000001E0000-0x000000000034C000-memory.dmp

Filesize
1.4MB

Download
memory/2984-2-0x000007FEF5A73000-0x000007FEF5A74000-memory.dmp

Filesize
4KB

Download