1e848b50a2c3344b77b89c3b4b33517a665b140495a18bdb8f34595652ee8b97

Analysis

max time kernel
23s
max time network
17s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 12:08

Target

ref/Avatar PSN Tools.exe
Size

7KB
MD5

84865470ecc1b1d3922d8e6619ac0912
SHA1

0d45e0cc8453d27384c10928a743299e6fadec37
SHA256

db487e1f264f4d3ff983b79e6fd5dc22b1a567a6865ae9f557e075350bf8169f
SHA512

4da8b3e671e080c515eb0b08161dbb8729a96b277473d3c033d5002490f0f66d001ecb3771ae0431efa8b942f8a588c7d3bf3f9d804de7fe50c198cb096bf2c9
SSDEEP

96:wsEIYyvvmJO1gAktFrXPwLNnizJrFIdnlhXupzSiT8xixuVxKwxxYxOzNt:aI3mJOSAktFrXPKN+J+dLvg6fx6m

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2072	2268	Avatar PSN Tools.exe	28
PID 2268 wrote to memory of 2072	2268	Avatar PSN Tools.exe	28
PID 2268 wrote to memory of 2072	2268	Avatar PSN Tools.exe	28

C:\Users\Admin\AppData\Local\Temp\ref\Avatar PSN Tools.exe
"C:\Users\Admin\AppData\Local\Temp\ref\Avatar PSN Tools.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2268 -s 476
  2⤵
  PID:2072

memory/2268-0-0x000007FEF5FC3000-0x000007FEF5FC4000-memory.dmp

Filesize
4KB

Download
memory/2268-1-0x0000000000350000-0x000000000035A000-memory.dmp

Filesize
40KB

Download
memory/2268-2-0x000007FEF5FC3000-0x000007FEF5FC4000-memory.dmp

Filesize
4KB

Download