26c64c2fafcd264b8130462ff6e40a6498ec6937fe95d5e83964388ae9597c4d

Resubmissions

11-05-2024 09:02

11-05-2024 09:00

max time kernel
44s
max time network
16s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 09:02

Target

Optimizer.exe
Size

2.4MB
MD5

cc4ed359031db8b3816f280a0cbda217
SHA1

537f393978f91eef2ac22ce82ee1b2f9c6dd2d72
SHA256

26c64c2fafcd264b8130462ff6e40a6498ec6937fe95d5e83964388ae9597c4d
SHA512

e443b5cb8b86a919a800825204624b651b5196e043d83529014625d7e161a6f7a6083857d2415eaa6293cf312389fbf39ea9a338307e8270dcc4812136e84077
SSDEEP

24576:S2mofuHtzyxlMOlJv8EC8KJWGlF+Bjk38WuBcAbwoA/BkjSHXP36RMG:S2msuHtzyxl+EC8KoVCSA/Bkj0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Optimizer.exe

description	pid	process	target process
PID 2080 wrote to memory of 1260	2080	Optimizer.exe	WerFault.exe
PID 2080 wrote to memory of 1260	2080	Optimizer.exe	WerFault.exe
PID 2080 wrote to memory of 1260	2080	Optimizer.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Optimizer.exe
"C:\Users\Admin\AppData\Local\Temp\Optimizer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2080 -s 748
2⤵
PID:1260

memory/2080-0-0x000007FEF56E3000-0x000007FEF56E4000-memory.dmp

Filesize
4KB

Download
memory/2080-1-0x0000000000250000-0x00000000004BA000-memory.dmp

Filesize
2.4MB

Download
memory/2080-2-0x000000001AF80000-0x000000001B032000-memory.dmp

Filesize
712KB

Download
memory/2080-23-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

Filesize
9.9MB

Download
memory/2080-25-0x000007FEF56E3000-0x000007FEF56E4000-memory.dmp

Filesize
4KB

Download
memory/2080-26-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

Filesize
9.9MB

Download