995be9c41a32de3f33272a19dc149a114dc4cf38379333be15e35f6c0c326d4c

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:28

Target

995be9c41a32de3f33272a19dc149a114dc4cf38379333be15e35f6c0c326d4c.exe
Size

82KB
MD5

3a57f04198af33f8c390102c10db1ba9
SHA1

6ab8928ba638f32c30e31d6c9f7952c8488e63f4
SHA256

995be9c41a32de3f33272a19dc149a114dc4cf38379333be15e35f6c0c326d4c
SHA512

78108efb64c0524269186aa4a920f36b47c7088352b21874f339809cb3bb9f7feb9b865a4b0380f44057742f78a84f16257ccf37aba04df6a4054816bb8b7126
SSDEEP

1536:KFjkY+eDsV6q9HDvrNHCu7yV48aNt7kQ+2bMXo1Qz2WXBOt38fZmruxRZ1ayLQwo:Ojv+eD6UJhDHyeZ/GEHuYJc24J

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

995be9c41a32de3f33272a19dc149a114dc4cf38379333be15e35f6c0c326d4c.exe

description	pid	process	target process
PID 1964 wrote to memory of 1252	1964	995be9c41a32de3f33272a19dc149a114dc4cf38379333be15e35f6c0c326d4c.exe	WerFault.exe
PID 1964 wrote to memory of 1252	1964	995be9c41a32de3f33272a19dc149a114dc4cf38379333be15e35f6c0c326d4c.exe	WerFault.exe
PID 1964 wrote to memory of 1252	1964	995be9c41a32de3f33272a19dc149a114dc4cf38379333be15e35f6c0c326d4c.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\995be9c41a32de3f33272a19dc149a114dc4cf38379333be15e35f6c0c326d4c.exe
"C:\Users\Admin\AppData\Local\Temp\995be9c41a32de3f33272a19dc149a114dc4cf38379333be15e35f6c0c326d4c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1964 -s 488
2⤵
PID:1252

memory/1964-0-0x000007FEF60B3000-0x000007FEF60B4000-memory.dmp

Filesize
4KB

Download
memory/1964-1-0x0000000000D70000-0x0000000000D86000-memory.dmp

Filesize
88KB

Download