6f4571882606ee838590243876609effc6a78455fde3a908ed9f9220758c8eb9

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:38

Target

6f4571882606ee838590243876609effc6a78455fde3a908ed9f9220758c8eb9.exe
Size

449KB
MD5

58a728da4e405ca979e73e774fe72fb9
SHA1

33bfff315ba2bdef39002d8cc066b513cfe70aae
SHA256

6f4571882606ee838590243876609effc6a78455fde3a908ed9f9220758c8eb9
SHA512

660748265950e3a7836c273a8bdba75296993c4510256bda4b531cb85f68b6f00652d584326bf0df5615265a88220a5f6fd4f5af09c59679e3debe6818cd3dce
SSDEEP

1536:wC4qH594gLbOWgoI9CKtc4x9Rfy+3YVad1R:wCB3rSJ3CsrkUd1R

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

6f4571882606ee838590243876609effc6a78455fde3a908ed9f9220758c8eb9.exe

description	pid	process	target process
PID 2600 wrote to memory of 2240	2600	6f4571882606ee838590243876609effc6a78455fde3a908ed9f9220758c8eb9.exe	WerFault.exe
PID 2600 wrote to memory of 2240	2600	6f4571882606ee838590243876609effc6a78455fde3a908ed9f9220758c8eb9.exe	WerFault.exe
PID 2600 wrote to memory of 2240	2600	6f4571882606ee838590243876609effc6a78455fde3a908ed9f9220758c8eb9.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6f4571882606ee838590243876609effc6a78455fde3a908ed9f9220758c8eb9.exe
"C:\Users\Admin\AppData\Local\Temp\6f4571882606ee838590243876609effc6a78455fde3a908ed9f9220758c8eb9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2600

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2600 -s 532
2⤵
PID:2240

memory/2600-0-0x000007FEF5623000-0x000007FEF5624000-memory.dmp

Filesize
4KB

Download
memory/2600-1-0x0000000001260000-0x00000000012D6000-memory.dmp

Filesize
472KB

Download
memory/2600-2-0x000007FEF5623000-0x000007FEF5624000-memory.dmp

Filesize
4KB

Download