1cee7f738f2ee7a57c818ffd0a14dd259fe4c269a6f42f39fb8b70eb6cfbb6bf

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 01:12

Target

1cee7f738f2ee7a57c818ffd0a14dd259fe4c269a6f42f39fb8b70eb6cfbb6bf.exe
Size

139KB
MD5

f6c5cf26fae985dc4f2037b1a4de4a1c
SHA1

ce5d95b657745e8ea62cdd2a15c055255a1560f8
SHA256

1cee7f738f2ee7a57c818ffd0a14dd259fe4c269a6f42f39fb8b70eb6cfbb6bf
SHA512

60f9d690067a0840627cf437dfb50d537c74b2f7c6cfcf644a51ccdfc3ccbcf6c64cd7951e65908421905cd3a1240660b5633704874833217f35528cdc6eb1ca
SSDEEP

3072:KmYIbnVAFXeRo1e6bWMKQo+rzoJFyBtYoJ:XVFRo15hxfmFNu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2016	1968	1cee7f738f2ee7a57c818ffd0a14dd259fe4c269a6f42f39fb8b70eb6cfbb6bf.exe	29
PID 1968 wrote to memory of 2016	1968	1cee7f738f2ee7a57c818ffd0a14dd259fe4c269a6f42f39fb8b70eb6cfbb6bf.exe	29
PID 1968 wrote to memory of 2016	1968	1cee7f738f2ee7a57c818ffd0a14dd259fe4c269a6f42f39fb8b70eb6cfbb6bf.exe	29

C:\Users\Admin\AppData\Local\Temp\1cee7f738f2ee7a57c818ffd0a14dd259fe4c269a6f42f39fb8b70eb6cfbb6bf.exe
"C:\Users\Admin\AppData\Local\Temp\1cee7f738f2ee7a57c818ffd0a14dd259fe4c269a6f42f39fb8b70eb6cfbb6bf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1968 -s 584
  2⤵
  PID:2016

memory/1968-0-0x000007FEF5B33000-0x000007FEF5B34000-memory.dmp

Filesize
4KB

Download
memory/1968-1-0x00000000013D0000-0x00000000013DA000-memory.dmp

Filesize
40KB

Download
memory/1968-2-0x000007FEF5B30000-0x000007FEF651C000-memory.dmp

Filesize
9.9MB

Download
memory/1968-3-0x000007FEF5B33000-0x000007FEF5B34000-memory.dmp

Filesize
4KB

Download