48dc198eea8bc8ddc0988f70a0fdac9a12a327138e984c297437fd4402a07a59

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 22:06

Target

48dc198eea8bc8ddc0988f70a0fdac9a12a327138e984c297437fd4402a07a59.exe
Size

469KB
MD5

529e52887ee808f8e1a88e5c6ff0728e
SHA1

62efaa254162de1a134925262bdd7e18644c8507
SHA256

48dc198eea8bc8ddc0988f70a0fdac9a12a327138e984c297437fd4402a07a59
SHA512

498b5cc38f5c7e154242137cc1d558cf8499a84404aa9284e527cfcf989b4a820a8939354d90d63b57cae11bd96ee2b02ae1d1781a6d4cba13296ddad73a4088
SSDEEP

6144:jsUO4aLYNjxBTK9MGDZylZwR//////////////////KXRhRydBRyd2:jVdlKGGAlZM//////////////////yw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1732	2128	48dc198eea8bc8ddc0988f70a0fdac9a12a327138e984c297437fd4402a07a59.exe	28
PID 2128 wrote to memory of 1732	2128	48dc198eea8bc8ddc0988f70a0fdac9a12a327138e984c297437fd4402a07a59.exe	28
PID 2128 wrote to memory of 1732	2128	48dc198eea8bc8ddc0988f70a0fdac9a12a327138e984c297437fd4402a07a59.exe	28

C:\Users\Admin\AppData\Local\Temp\48dc198eea8bc8ddc0988f70a0fdac9a12a327138e984c297437fd4402a07a59.exe
"C:\Users\Admin\AppData\Local\Temp\48dc198eea8bc8ddc0988f70a0fdac9a12a327138e984c297437fd4402a07a59.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2128 -s 528
  2⤵
  PID:1732

memory/2128-0-0x000007FEF5433000-0x000007FEF5434000-memory.dmp

Filesize
4KB

Download
memory/2128-1-0x00000000011A0000-0x000000000121A000-memory.dmp

Filesize
488KB

Download