a0717374979c8809e05aa848ffa7a72311d6a18850a1c7963ab50a6a19e534fa

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 07:14

Target

a0717374979c8809e05aa848ffa7a72311d6a18850a1c7963ab50a6a19e534fa.exe
Size

6KB
MD5

fed19f002e6b0d83b77add8fb1c77ac9
SHA1

9f1314908688be8fe5d88d6095ab96ff00c4d1e4
SHA256

a0717374979c8809e05aa848ffa7a72311d6a18850a1c7963ab50a6a19e534fa
SHA512

6722b5cb9acdbcb5a00251273510c028a389b027bc3a455a300ab011b908ea793a99602d123cb63077da251714d1e71cb594962c7d71aa57962b5de423d537ec
SSDEEP

48:Sxbt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9usO:40mIGnFc/38+N4ZHJWSY9FI5Wqdx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2324	1752	a0717374979c8809e05aa848ffa7a72311d6a18850a1c7963ab50a6a19e534fa.exe	28
PID 1752 wrote to memory of 2324	1752	a0717374979c8809e05aa848ffa7a72311d6a18850a1c7963ab50a6a19e534fa.exe	28
PID 1752 wrote to memory of 2324	1752	a0717374979c8809e05aa848ffa7a72311d6a18850a1c7963ab50a6a19e534fa.exe	28

C:\Users\Admin\AppData\Local\Temp\a0717374979c8809e05aa848ffa7a72311d6a18850a1c7963ab50a6a19e534fa.exe
"C:\Users\Admin\AppData\Local\Temp\a0717374979c8809e05aa848ffa7a72311d6a18850a1c7963ab50a6a19e534fa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1752 -s 32
  2⤵
  PID:2324