2e6314a6721ade872f5d20bb2e5bcb6f98eb16add5db89d421457830c01b7fdc

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:17

Target

2e6314a6721ade872f5d20bb2e5bcb6f98eb16add5db89d421457830c01b7fdc.exe
Size

2.8MB
MD5

ad09def71b89513a4a407fd37b54d84e
SHA1

4d84f85c0bac0ec94930c1854feac5f7dbe47b25
SHA256

2e6314a6721ade872f5d20bb2e5bcb6f98eb16add5db89d421457830c01b7fdc
SHA512

6f8a2fe0fc8e4557ed4e7dc00847016396d2aceb90c48498efc5286d6c806638aa67ee8deaa8a9ecfd665454301a84eed93f97b515d6367bcc8e88515e5ddcb6
SSDEEP

24576:s9JA0n2Sra1lFEcCTJnmFWK8E8K5V24j5ZG6Kv:s9JzruUT5UG6Kv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2e6314a6721ade872f5d20bb2e5bcb6f98eb16add5db89d421457830c01b7fdc.exe

description	pid	process	target process
PID 1680 wrote to memory of 2156	1680	2e6314a6721ade872f5d20bb2e5bcb6f98eb16add5db89d421457830c01b7fdc.exe	WerFault.exe
PID 1680 wrote to memory of 2156	1680	2e6314a6721ade872f5d20bb2e5bcb6f98eb16add5db89d421457830c01b7fdc.exe	WerFault.exe
PID 1680 wrote to memory of 2156	1680	2e6314a6721ade872f5d20bb2e5bcb6f98eb16add5db89d421457830c01b7fdc.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2e6314a6721ade872f5d20bb2e5bcb6f98eb16add5db89d421457830c01b7fdc.exe
"C:\Users\Admin\AppData\Local\Temp\2e6314a6721ade872f5d20bb2e5bcb6f98eb16add5db89d421457830c01b7fdc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1680 -s 536
  2⤵
  PID:2156

memory/1680-0-0x000007FEF5C73000-0x000007FEF5C74000-memory.dmp

Filesize
4KB

Download
memory/1680-1-0x000000003F490000-0x000000003F75C000-memory.dmp

Filesize
2.8MB

Download
memory/1680-2-0x000007FEF5C73000-0x000007FEF5C74000-memory.dmp

Filesize
4KB

Download