bc5f784167086c85fbe8e2a8085d2b8a5784217f0e5e3cafce545b09514b9fce

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 12:03

Target

Arcos.exe
Size

177KB
MD5

5d21623d7d4cc17b4dab920a40b6c7ff
SHA1

a8663af0b137678068d20fc154ddf49114b26e97
SHA256

bc5f784167086c85fbe8e2a8085d2b8a5784217f0e5e3cafce545b09514b9fce
SHA512

fc28bba7a4ad5c68f2ed62cc39ed5d67c044a462c6fe336ef8c723c9f406a1baf9bcdfa8bc8c7020e6d442578a6f234a87fbdf1af8c51be4cafd1c830c642d9f
SSDEEP

3072:wShNjxgnNwEG+81lhc5SdUWloVs+XZwRq5/TRiT3JAVmSooOCTEKjMLddptVZY32:D+81lhc5SdUWlLwimtQ3JAVmhptVZY3b

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2188	2292	Arcos.exe	29
PID 2292 wrote to memory of 2188	2292	Arcos.exe	29
PID 2292 wrote to memory of 2188	2292	Arcos.exe	29

C:\Users\Admin\AppData\Local\Temp\Arcos.exe
"C:\Users\Admin\AppData\Local\Temp\Arcos.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2292 -s 496
  2⤵
  PID:2188

memory/2292-0-0x000007FEF51A3000-0x000007FEF51A4000-memory.dmp

Filesize
4KB

Download
memory/2292-1-0x000000013F120000-0x000000013F150000-memory.dmp

Filesize
192KB

Download
memory/2292-2-0x000007FEF51A3000-0x000007FEF51A4000-memory.dmp

Filesize
4KB

Download