a11c6e3abba5753823206a878bbb5194d9612002da853fa87b8bd3af3ffbaa02

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:50

Target

a11c6e3abba5753823206a878bbb5194d9612002da853fa87b8bd3af3ffbaa02.exe
Size

687KB
MD5

cadfc5f7a44bcc9fa3a9cd2a530b221c
SHA1

f3a91b3798253458c10192142d38b8bea5eec46d
SHA256

a11c6e3abba5753823206a878bbb5194d9612002da853fa87b8bd3af3ffbaa02
SHA512

cde5a85e611e247cc2f2cc5272d08c3c1b19c3a629d683975485a1199248e3a6c6310c35fb0b06b8bbffd9e038dceb9095e871dc3d7a30e6892e458d5daecb52
SSDEEP

12288:B7dVoO7f2CfoQmfzkL8SO+dox0gaAWoo6wgGceklmRGI0qCci8wELBAQSDS/d0w2:B75+CfTmfoPMx0gunbkk9pB8D60wUg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a11c6e3abba5753823206a878bbb5194d9612002da853fa87b8bd3af3ffbaa02.exe

description	pid	process	target process
PID 2216 wrote to memory of 2548	2216	a11c6e3abba5753823206a878bbb5194d9612002da853fa87b8bd3af3ffbaa02.exe	WerFault.exe
PID 2216 wrote to memory of 2548	2216	a11c6e3abba5753823206a878bbb5194d9612002da853fa87b8bd3af3ffbaa02.exe	WerFault.exe
PID 2216 wrote to memory of 2548	2216	a11c6e3abba5753823206a878bbb5194d9612002da853fa87b8bd3af3ffbaa02.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a11c6e3abba5753823206a878bbb5194d9612002da853fa87b8bd3af3ffbaa02.exe
"C:\Users\Admin\AppData\Local\Temp\a11c6e3abba5753823206a878bbb5194d9612002da853fa87b8bd3af3ffbaa02.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2216

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2216 -s 636
2⤵
PID:2548

memory/2216-0-0x000007FEF5533000-0x000007FEF5534000-memory.dmp

Filesize
4KB

Download
memory/2216-1-0x0000000001230000-0x00000000012E2000-memory.dmp

Filesize
712KB

Download
memory/2216-2-0x000007FEF5530000-0x000007FEF5F1C000-memory.dmp

Filesize
9.9MB

Download
memory/2216-3-0x0000000000EE0000-0x0000000000F84000-memory.dmp

Filesize
656KB

Download
memory/2216-4-0x000007FEF5530000-0x000007FEF5F1C000-memory.dmp

Filesize
9.9MB

Download