23ab8acc6de8974485fbf8f08da9578ec130a967a78d8c2505a119672934412a

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 06:27

Target

23ab8acc6de8974485fbf8f08da9578ec130a967a78d8c2505a119672934412a.exe
Size

674KB
MD5

58bef61c8eb38a792497bf4db53b7265
SHA1

6d3eb47b09b8bba8ab4fbffc8d3c549555d2efae
SHA256

23ab8acc6de8974485fbf8f08da9578ec130a967a78d8c2505a119672934412a
SHA512

9016a83b31a5db1dc8d0e900c5981e27fa81a4c6054564a93a562c9ecde99f2d2a2450e8e8210f58f62a17595ccb65112569ce7456c8100fce91117b6d8b3d1e
SSDEEP

6144:GvZCqtNVfi0ZzEGFwMHViJ1bK+zjD+FM0kz6kUJYeASlF/+xZRtiKzvzaOchYX:GvZCCukzEGCMHViPbK+zWFPkzNzDKOX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

23ab8acc6de8974485fbf8f08da9578ec130a967a78d8c2505a119672934412a.exe

description	pid	process	target process
PID 2576 wrote to memory of 1984	2576	23ab8acc6de8974485fbf8f08da9578ec130a967a78d8c2505a119672934412a.exe	WerFault.exe
PID 2576 wrote to memory of 1984	2576	23ab8acc6de8974485fbf8f08da9578ec130a967a78d8c2505a119672934412a.exe	WerFault.exe
PID 2576 wrote to memory of 1984	2576	23ab8acc6de8974485fbf8f08da9578ec130a967a78d8c2505a119672934412a.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\23ab8acc6de8974485fbf8f08da9578ec130a967a78d8c2505a119672934412a.exe
"C:\Users\Admin\AppData\Local\Temp\23ab8acc6de8974485fbf8f08da9578ec130a967a78d8c2505a119672934412a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2576 -s 76
  2⤵
  PID:1984