ecddc24108d455fbcde3278809cbd97219a25984f71ce79fd2df084e2c90e1fb

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 14:16

Target

ecddc24108d455fbcde3278809cbd97219a25984f71ce79fd2df084e2c90e1fb.exe
Size

1.4MB
MD5

8f95981783c7a2f5f8b98df1b4ef4a9e
SHA1

093d67b2e5201563ff7ec1ea1cadf4d336ab115e
SHA256

ecddc24108d455fbcde3278809cbd97219a25984f71ce79fd2df084e2c90e1fb
SHA512

2d3c62f5e55157f110148752e372c05ffe4b9836fc0e6884e89acbfa15dfd32571d8580a0e9af14276b1f05ba0be9f16ae21d0d9106f095459b27fdacf10606c
SSDEEP

24576:zS2r2fUlJc3K9h1d4jWUzrq4xQkQvwZHbJ7Bx4ZDSgsoi:08o3ehLq5rq4fQvwNV774bi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1952	2124	ecddc24108d455fbcde3278809cbd97219a25984f71ce79fd2df084e2c90e1fb.exe	28
PID 2124 wrote to memory of 1952	2124	ecddc24108d455fbcde3278809cbd97219a25984f71ce79fd2df084e2c90e1fb.exe	28
PID 2124 wrote to memory of 1952	2124	ecddc24108d455fbcde3278809cbd97219a25984f71ce79fd2df084e2c90e1fb.exe	28

C:\Users\Admin\AppData\Local\Temp\ecddc24108d455fbcde3278809cbd97219a25984f71ce79fd2df084e2c90e1fb.exe
"C:\Users\Admin\AppData\Local\Temp\ecddc24108d455fbcde3278809cbd97219a25984f71ce79fd2df084e2c90e1fb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2124 -s 144
  2⤵
  PID:1952