af4a80c07d9bc62221b09ab18e2b63a756c6b15f151fcd1a331d81d46c814cda

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 17:55

Target

RoseBETA2/CefSharp.BrowserSubprocess.exe
Size

6KB
MD5

bcd22b9511d5383e23d875e2cf3c339e
SHA1

0ef86afaef536cc4b046ea2866414bb193d60702
SHA256

95dd31f11ac1317559b6eee0479739930d503a4938283f5d831ac8add92ad792
SHA512

c4e6821858720895c0bfae797097e3307bb7ea8f03dde4fefc16cce03b2a50fecfe8ed5c3225136fcd9d74ee0ed8673f795b410cd14890d22df58c1f03b693c6
SSDEEP

96:v6ZxBI7kNmQBDvJGSkX6eFZJetmAhNt61OYcXe5U:UBIimQB9eX6eFZgsAYcXeS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2784	2996	CefSharp.BrowserSubprocess.exe	28
PID 2996 wrote to memory of 2784	2996	CefSharp.BrowserSubprocess.exe	28
PID 2996 wrote to memory of 2784	2996	CefSharp.BrowserSubprocess.exe	28

C:\Users\Admin\AppData\Local\Temp\RoseBETA2\CefSharp.BrowserSubprocess.exe
"C:\Users\Admin\AppData\Local\Temp\RoseBETA2\CefSharp.BrowserSubprocess.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2996 -s 528
  2⤵
  PID:2784

memory/2996-0-0x000007FEF50F3000-0x000007FEF50F4000-memory.dmp

Filesize
4KB

Download
memory/2996-1-0x000000013FAF0000-0x000000013FAF6000-memory.dmp

Filesize
24KB

Download
memory/2996-2-0x0000000000A70000-0x0000000000ABA000-memory.dmp

Filesize
296KB

Download
memory/2996-3-0x000000001C9E0000-0x000000001CAFE000-memory.dmp

Filesize
1.1MB

Download
memory/2996-4-0x000007FEF50F3000-0x000007FEF50F4000-memory.dmp

Filesize
4KB

Download