275962b47cdc699a517c761bb8f7078d09323881dfafbb87bec3cd9d652ee905

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 10:06

Target

RoseBETA2/CefSharp.BrowserSubprocess.exe
Size

6KB
MD5

bcd22b9511d5383e23d875e2cf3c339e
SHA1

0ef86afaef536cc4b046ea2866414bb193d60702
SHA256

95dd31f11ac1317559b6eee0479739930d503a4938283f5d831ac8add92ad792
SHA512

c4e6821858720895c0bfae797097e3307bb7ea8f03dde4fefc16cce03b2a50fecfe8ed5c3225136fcd9d74ee0ed8673f795b410cd14890d22df58c1f03b693c6
SSDEEP

96:v6ZxBI7kNmQBDvJGSkX6eFZJetmAhNt61OYcXe5U:UBIimQB9eX6eFZgsAYcXeS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2652	1736	CefSharp.BrowserSubprocess.exe	28
PID 1736 wrote to memory of 2652	1736	CefSharp.BrowserSubprocess.exe	28
PID 1736 wrote to memory of 2652	1736	CefSharp.BrowserSubprocess.exe	28

C:\Users\Admin\AppData\Local\Temp\RoseBETA2\CefSharp.BrowserSubprocess.exe
"C:\Users\Admin\AppData\Local\Temp\RoseBETA2\CefSharp.BrowserSubprocess.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1736 -s 524
  2⤵
  PID:2652

memory/1736-0-0x000007FEF5CA3000-0x000007FEF5CA4000-memory.dmp

Filesize
4KB

Download
memory/1736-1-0x000000013F5C0000-0x000000013F5C6000-memory.dmp

Filesize
24KB

Download
memory/1736-2-0x0000000000C70000-0x0000000000CBA000-memory.dmp

Filesize
296KB

Download
memory/1736-3-0x000000001C820000-0x000000001C93E000-memory.dmp

Filesize
1.1MB

Download
memory/1736-4-0x000007FEF5CA3000-0x000007FEF5CA4000-memory.dmp

Filesize
4KB

Download