ab1526657d0948b1ed4a2becdf2c3331dcf82c02a55d93930d37352a6f41f5ca

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:41

Target

ab1526657d0948b1ed4a2becdf2c3331dcf82c02a55d93930d37352a6f41f5ca.exe
Size

232KB
MD5

a7db308aab694d064742bbdf2ac1ccdc
SHA1

2e3de382818d4f15af84d4da66983feca1962e37
SHA256

ab1526657d0948b1ed4a2becdf2c3331dcf82c02a55d93930d37352a6f41f5ca
SHA512

128c85dbf4d3b9a94d057d71a81c791949b163f162d775a9b483f1d8aea9fb1e0cb3de9c9b1802fac156f0060b387807fb2ae4e9fe3643f7b5613a75c9a7d501
SSDEEP

3072:AFfBFotnuF9TP4xZQkVyEmq9A67eIKco3lWRavWDcQyP0PGJ4tstmWg5ovsdCSwO:WshxDRqhucwPGJ4tUM5ocwYi28FnU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ab1526657d0948b1ed4a2becdf2c3331dcf82c02a55d93930d37352a6f41f5ca.exe

description	pid	process	target process
PID 836 wrote to memory of 1808	836	ab1526657d0948b1ed4a2becdf2c3331dcf82c02a55d93930d37352a6f41f5ca.exe	WerFault.exe
PID 836 wrote to memory of 1808	836	ab1526657d0948b1ed4a2becdf2c3331dcf82c02a55d93930d37352a6f41f5ca.exe	WerFault.exe
PID 836 wrote to memory of 1808	836	ab1526657d0948b1ed4a2becdf2c3331dcf82c02a55d93930d37352a6f41f5ca.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ab1526657d0948b1ed4a2becdf2c3331dcf82c02a55d93930d37352a6f41f5ca.exe
"C:\Users\Admin\AppData\Local\Temp\ab1526657d0948b1ed4a2becdf2c3331dcf82c02a55d93930d37352a6f41f5ca.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 836 -s 528
2⤵
PID:1808

memory/836-0-0x000007FEF5823000-0x000007FEF5824000-memory.dmp

Filesize
4KB

Download
memory/836-1-0x00000000000C0000-0x0000000000102000-memory.dmp

Filesize
264KB

Download
memory/836-2-0x000007FEF5823000-0x000007FEF5824000-memory.dmp

Filesize
4KB

Download