c5746323feb5767de7ca29e232458386f5699e21c013d714e37acb6b77bd824a

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 01:07

Target

c5746323feb5767de7ca29e232458386f5699e21c013d714e37acb6b77bd824a.exe
Size

1.4MB
MD5

c730cd2d84cfadc530360d91b2bc2791
SHA1

e7f5258dbaf4e43e154068859042028545b1e873
SHA256

c5746323feb5767de7ca29e232458386f5699e21c013d714e37acb6b77bd824a
SHA512

a9f10cc7946bdb1901b2e0dfb8eced2e5c1947d1c24525036f6120de479c4ff13cfd917bcda3f3b148f931056ad021204e63bfa59194981695f16f22fb4928ef
SSDEEP

24576:rNnYahM9SH+ZeqWiIXaowZimVhChgKvaUIdY:rNYahM9SH+ZeqzIXyJChAjm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 3056	1576	c5746323feb5767de7ca29e232458386f5699e21c013d714e37acb6b77bd824a.exe	28
PID 1576 wrote to memory of 3056	1576	c5746323feb5767de7ca29e232458386f5699e21c013d714e37acb6b77bd824a.exe	28
PID 1576 wrote to memory of 3056	1576	c5746323feb5767de7ca29e232458386f5699e21c013d714e37acb6b77bd824a.exe	28

C:\Users\Admin\AppData\Local\Temp\c5746323feb5767de7ca29e232458386f5699e21c013d714e37acb6b77bd824a.exe
"C:\Users\Admin\AppData\Local\Temp\c5746323feb5767de7ca29e232458386f5699e21c013d714e37acb6b77bd824a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1576 -s 660
  2⤵
  PID:3056

memory/1576-0-0x000007FEF5B33000-0x000007FEF5B34000-memory.dmp

Filesize
4KB

Download
memory/1576-1-0x0000000000CE0000-0x0000000000E4C000-memory.dmp

Filesize
1.4MB

Download
memory/1576-2-0x000007FEF5B30000-0x000007FEF651C000-memory.dmp

Filesize
9.9MB

Download
memory/1576-3-0x000007FEF5B33000-0x000007FEF5B34000-memory.dmp

Filesize
4KB

Download
memory/1576-4-0x000007FEF5B30000-0x000007FEF651C000-memory.dmp

Filesize
9.9MB

Download