da4a5ec0be0c4685324995e1a36182f19de1a2a87002765307b39794903f4cc1

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 14:13

Target

Buzones_Compartidos (1).exe
Size

14KB
MD5

5584acd9d3974bc865c506d9b1a07433
SHA1

0efb578f18764483443358767124995efe6d1e77
SHA256

da4a5ec0be0c4685324995e1a36182f19de1a2a87002765307b39794903f4cc1
SHA512

1b889b06bfe40657446402ce52c34f37ab18aabca2158d349ccca7e791d905cc69fd3698612cd9207afeeef8c75d4d417805af9fb8549e2d62db431756ec04ce
SSDEEP

192:rPFLcCN0WdM7Masy6T4YtK/T0YmYV52QYu3hJWr45aadrq8uSF3:rPFLJG/WT4Yt6T0YmeoQ33h8r45JUSF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2272	2228	Buzones_Compartidos (1).exe	29
PID 2228 wrote to memory of 2272	2228	Buzones_Compartidos (1).exe	29
PID 2228 wrote to memory of 2272	2228	Buzones_Compartidos (1).exe	29

C:\Users\Admin\AppData\Local\Temp\Buzones_Compartidos (1).exe
"C:\Users\Admin\AppData\Local\Temp\Buzones_Compartidos (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2228 -s 516
  2⤵
  PID:2272

memory/2228-0-0x000007FEF5603000-0x000007FEF5604000-memory.dmp

Filesize
4KB

Download
memory/2228-1-0x0000000000D60000-0x0000000000D68000-memory.dmp

Filesize
32KB

Download
memory/2228-2-0x000007FEF5603000-0x000007FEF5604000-memory.dmp

Filesize
4KB

Download