eaea60d86d378692e8630a5c575889f4f56de42200f034c761fe451d94c6d60d

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 16:35

Target

SRC/Phemedrone.Panel/obj/Debug/net7.0/Phemedrone.Panel.exe
Size

31KB
MD5

55a0c6b4690ba8fae321d2b1c8939141
SHA1

f210cad92ffeccd68ab2e02b7d1ce9c12e2194ee
SHA256

2092b040b58a6f18784c3f141e24a8203cdae241c52322b08818531a9f0952cc
SHA512

01f25519012d2bf97a7290949e161b7daded77d6e4bf9e046c51df43aaf6b33aab2fc659e611cbcaa44a5ce0312fd398603b2dd3803fc4d39fd232ce1ff5578e
SSDEEP

768:+5mBvLDW+km1UgPZqXwFXju+e3LoTUTHe:5HRkwxEyXjuvLCUT+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Phemedrone.Panel.exe

description	pid	process	target process
PID 2908 wrote to memory of 2160	2908	Phemedrone.Panel.exe	WerFault.exe
PID 2908 wrote to memory of 2160	2908	Phemedrone.Panel.exe	WerFault.exe
PID 2908 wrote to memory of 2160	2908	Phemedrone.Panel.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SRC\Phemedrone.Panel\obj\Debug\net7.0\Phemedrone.Panel.exe
"C:\Users\Admin\AppData\Local\Temp\SRC\Phemedrone.Panel\obj\Debug\net7.0\Phemedrone.Panel.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2908 -s 508
  2⤵
  PID:2160

memory/2908-0-0x000007FEF5353000-0x000007FEF5354000-memory.dmp

Filesize
4KB

Download
memory/2908-1-0x0000000000CD0000-0x0000000000CDE000-memory.dmp

Filesize
56KB

Download
memory/2908-2-0x000007FEF5353000-0x000007FEF5354000-memory.dmp

Filesize
4KB

Download