2e8c06ecb13d79ee372de50f85428aeb5547206d43ecb176c500b143eee5e1b4

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 22:30

Target

2e8c06ecb13d79ee372de50f85428aeb5547206d43ecb176c500b143eee5e1b4.exe
Size

808KB
MD5

db65329760e61f82bb5a303db40b96fc
SHA1

8e56c5d50174e0b871cab30b3536a4f71d791bfe
SHA256

2e8c06ecb13d79ee372de50f85428aeb5547206d43ecb176c500b143eee5e1b4
SHA512

507215d3e180cdc8ba78fdcace2732e9ef20fe77828d5389b6c2f7bc55a077d417af6bdb4efc5db10c9c03699fe75270b30ee7e33d5fbe9c93c2fe1ebaf7a2d3
SSDEEP

12288:XWMaC0ozub7M/ZOENCCzn0GOiCnWIqyQZbA23Kq:mMaCnzq4ZOENCCzn+KbAwZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2356	2972	2e8c06ecb13d79ee372de50f85428aeb5547206d43ecb176c500b143eee5e1b4.exe	28
PID 2972 wrote to memory of 2356	2972	2e8c06ecb13d79ee372de50f85428aeb5547206d43ecb176c500b143eee5e1b4.exe	28
PID 2972 wrote to memory of 2356	2972	2e8c06ecb13d79ee372de50f85428aeb5547206d43ecb176c500b143eee5e1b4.exe	28

C:\Users\Admin\AppData\Local\Temp\2e8c06ecb13d79ee372de50f85428aeb5547206d43ecb176c500b143eee5e1b4.exe
"C:\Users\Admin\AppData\Local\Temp\2e8c06ecb13d79ee372de50f85428aeb5547206d43ecb176c500b143eee5e1b4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2972 -s 528
  2⤵
  PID:2356

memory/2972-0-0x000007FEF52D3000-0x000007FEF52D4000-memory.dmp

Filesize
4KB

Download
memory/2972-1-0x0000000010BF0000-0x0000000010CBC000-memory.dmp

Filesize
816KB

Download
memory/2972-2-0x000007FEF52D3000-0x000007FEF52D4000-memory.dmp

Filesize
4KB

Download