c7c1e87f74a0a769fed8b305ce43f926bd68e02e80f40976698366baa045b0cf

Analysis

max time kernel
142s
max time network
128s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 06:58

Target

bin/gspawn-win64-helper.exe
Size

25KB
MD5

a18db97a9a6c74266e1cd7620c736948
SHA1

2567499d835bf505b97efd4cf842db526049edbd
SHA256

ac126560dbdcb032848b0015576b1d9fe00173a3d927d17aa8f2a7b61428c080
SHA512

6ad7169b891cf31c6100afd51e4a5b255263f3a3fdd41f59955b7d4c9068057569dd286f6a3d58bd7e81b4d79191be7a3aff917c9c12875d0ddeaf77bd57c4fb
SSDEEP

384:fcXH/xWzMQTsK74Mm/K0kznRyOYDB1sYbMCWp7SMlX3k:fGxbftfk1yBV1LnWp7S4X3k

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 3056	2852	gspawn-win64-helper.exe	28
PID 2852 wrote to memory of 3056	2852	gspawn-win64-helper.exe	28
PID 2852 wrote to memory of 3056	2852	gspawn-win64-helper.exe	28

C:\Users\Admin\AppData\Local\Temp\bin\gspawn-win64-helper.exe
"C:\Users\Admin\AppData\Local\Temp\bin\gspawn-win64-helper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2852 -s 188
  2⤵
  PID:3056

memory/2852-0-0x000000013FA70000-0x000000013FA7E000-memory.dmp

Filesize
56KB

Download
memory/2852-1-0x000007FEF6AB0000-0x000007FEF6C08000-memory.dmp

Filesize
1.3MB

Download
memory/2852-2-0x000007FEFAF40000-0x000007FEFAF6C000-memory.dmp

Filesize
176KB

Download
memory/2852-4-0x000007FEF7690000-0x000007FEF76F7000-memory.dmp

Filesize
412KB

Download
memory/2852-3-0x000007FEF6560000-0x000007FEF6679000-memory.dmp

Filesize
1.1MB

Download