b4661adcd4f1a037346037efa829293b00d976c56bccc683c423e3a93a8da881

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 01:29

Target

b4661adcd4f1a037346037efa829293b00d976c56bccc683c423e3a93a8da881.exe
Size

25KB
MD5

0446fd1ab00e877ee83132179991399f
SHA1

b5aa6b4e37a9ae8737968940566db92ce10f15d2
SHA256

b4661adcd4f1a037346037efa829293b00d976c56bccc683c423e3a93a8da881
SHA512

f6a5aaa24535f519fe5f620d332bcfa963d246f31ab02420db5e5a8e46bcd255d4d9e57416c2f703061145e4199ef8f52e0867423a3adc581dc0cb4abf5b4865
SSDEEP

768:QEHP8+0Vfgno6zSKXqyfM41v1lbVxfgm3HrdA:QEHP8+01gVRzfX3y

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2756	2028	b4661adcd4f1a037346037efa829293b00d976c56bccc683c423e3a93a8da881.exe	29
PID 2028 wrote to memory of 2756	2028	b4661adcd4f1a037346037efa829293b00d976c56bccc683c423e3a93a8da881.exe	29
PID 2028 wrote to memory of 2756	2028	b4661adcd4f1a037346037efa829293b00d976c56bccc683c423e3a93a8da881.exe	29

C:\Users\Admin\AppData\Local\Temp\b4661adcd4f1a037346037efa829293b00d976c56bccc683c423e3a93a8da881.exe
"C:\Users\Admin\AppData\Local\Temp\b4661adcd4f1a037346037efa829293b00d976c56bccc683c423e3a93a8da881.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2028 -s 532
  2⤵
  PID:2756

memory/2028-0-0x000007FEF5783000-0x000007FEF5784000-memory.dmp

Filesize
4KB

Download
memory/2028-1-0x00000000010A0000-0x00000000010AC000-memory.dmp

Filesize
48KB

Download
memory/2028-2-0x000007FEF5783000-0x000007FEF5784000-memory.dmp

Filesize
4KB

Download