84a8c88fe2513215d97fc0e0a5b7447972562d69a7a33320dcff93673c2f210c

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 01:27

Target

84a8c88fe2513215d97fc0e0a5b7447972562d69a7a33320dcff93673c2f210c.exe
Size

252KB
MD5

160bc60144d426adb0f0e86ddd124b07
SHA1

ac47fa120f694b9c44e303f909369f4e2a9e987c
SHA256

84a8c88fe2513215d97fc0e0a5b7447972562d69a7a33320dcff93673c2f210c
SHA512

9e54a9b99870dc8b9bcc32a8899c870c84263b0d7023175e59e582ad9af2dea4a4dd7df374987ee6d1d49900144dd4c839088d6c54c9b6276df85597e97b1024
SSDEEP

3072:gnpQKHPUEsF6JonLClUmKWTWhpxTmOKTbmYRZjm1rd1GeHNPyW6EQz:upQKHMNFoonLC0nUOYbmYRNm1rPGeNn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1628	2236	84a8c88fe2513215d97fc0e0a5b7447972562d69a7a33320dcff93673c2f210c.exe	28
PID 2236 wrote to memory of 1628	2236	84a8c88fe2513215d97fc0e0a5b7447972562d69a7a33320dcff93673c2f210c.exe	28
PID 2236 wrote to memory of 1628	2236	84a8c88fe2513215d97fc0e0a5b7447972562d69a7a33320dcff93673c2f210c.exe	28

C:\Users\Admin\AppData\Local\Temp\84a8c88fe2513215d97fc0e0a5b7447972562d69a7a33320dcff93673c2f210c.exe
"C:\Users\Admin\AppData\Local\Temp\84a8c88fe2513215d97fc0e0a5b7447972562d69a7a33320dcff93673c2f210c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2236 -s 536
  2⤵
  PID:1628

memory/2236-0-0x000007FEF51A3000-0x000007FEF51A4000-memory.dmp

Filesize
4KB

Download
memory/2236-1-0x0000000000A70000-0x0000000000AB6000-memory.dmp

Filesize
280KB

Download
memory/2236-2-0x000007FEF51A3000-0x000007FEF51A4000-memory.dmp

Filesize
4KB

Download