0b452157350b9c91f8ec01b9260a4b1571063e25ba1fb7e6379dd9504951e11e

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 18:33

Target

0b452157350b9c91f8ec01b9260a4b1571063e25ba1fb7e6379dd9504951e11e.exe
Size

125KB
MD5

37ae07a5ceb35136d427577af8adaf53
SHA1

f743d16750dea860eae4579d9f7c33d52a31334a
SHA256

0b452157350b9c91f8ec01b9260a4b1571063e25ba1fb7e6379dd9504951e11e
SHA512

50623392a5a89260af263c54fa49d2ada290879f44efaae46903b6280f9684b3b9b2c52881bcb028e69b9fb97d733b9baa34b3d4de37546adedb677450e8e704
SSDEEP

3072:my2f6Kt7vWDEvGmY0Sw/T1GVeEzdHVV5719:f2f6C7vsI7hgEGHL571

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 1932	2156	0b452157350b9c91f8ec01b9260a4b1571063e25ba1fb7e6379dd9504951e11e.exe	28
PID 2156 wrote to memory of 1932	2156	0b452157350b9c91f8ec01b9260a4b1571063e25ba1fb7e6379dd9504951e11e.exe	28
PID 2156 wrote to memory of 1932	2156	0b452157350b9c91f8ec01b9260a4b1571063e25ba1fb7e6379dd9504951e11e.exe	28

C:\Users\Admin\AppData\Local\Temp\0b452157350b9c91f8ec01b9260a4b1571063e25ba1fb7e6379dd9504951e11e.exe
"C:\Users\Admin\AppData\Local\Temp\0b452157350b9c91f8ec01b9260a4b1571063e25ba1fb7e6379dd9504951e11e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2156 -s 500
  2⤵
  PID:1932

memory/2156-0-0x000007FEF5BE3000-0x000007FEF5BE4000-memory.dmp

Filesize
4KB

Download
memory/2156-1-0x0000000001260000-0x0000000001286000-memory.dmp

Filesize
152KB

Download
memory/2156-2-0x000007FEF5BE3000-0x000007FEF5BE4000-memory.dmp

Filesize
4KB

Download