fee7c66d3b87f0c649fd36de68a51766aa910d27d4c145cc6bb040883b0db2a0

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 08:51

Target

fee7c66d3b87f0c649fd36de68a51766aa910d27d4c145cc6bb040883b0db2a0.exe
Size

86KB
MD5

666748f1a95752287bf2d19163d895f6
SHA1

64cf20c84ed41c35de12978ce77fc20c4b91d8cf
SHA256

fee7c66d3b87f0c649fd36de68a51766aa910d27d4c145cc6bb040883b0db2a0
SHA512

eb368fd1259a566ed0f4f34f419ed6083e600fe5ba82e329adbd78b2dd7a1183cc05ddc754bfec4729874920bf7cbdd408e711af3c18f146e9bed7f8242c0756
SSDEEP

768:mfi201nyxmocxh2Xw48wsBFn8q1CVxmckAXE375109zbADj05sN9zcuG:mKHcxmoqkw489Bd8hVgAK6z0DQyvzcuG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fee7c66d3b87f0c649fd36de68a51766aa910d27d4c145cc6bb040883b0db2a0.exe

description	pid	process	target process
PID 2416 wrote to memory of 2632	2416	fee7c66d3b87f0c649fd36de68a51766aa910d27d4c145cc6bb040883b0db2a0.exe	WerFault.exe
PID 2416 wrote to memory of 2632	2416	fee7c66d3b87f0c649fd36de68a51766aa910d27d4c145cc6bb040883b0db2a0.exe	WerFault.exe
PID 2416 wrote to memory of 2632	2416	fee7c66d3b87f0c649fd36de68a51766aa910d27d4c145cc6bb040883b0db2a0.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fee7c66d3b87f0c649fd36de68a51766aa910d27d4c145cc6bb040883b0db2a0.exe
"C:\Users\Admin\AppData\Local\Temp\fee7c66d3b87f0c649fd36de68a51766aa910d27d4c145cc6bb040883b0db2a0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2416 -s 28
2⤵
PID:2632