41720887d7087390da6dac394ef3f30fe2f12c97352bd00401b2aa80f7c34c1f

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 20:51

Target

41720887d7087390da6dac394ef3f30fe2f12c97352bd00401b2aa80f7c34c1f.exe
Size

54KB
MD5

89e61b82f196c6d6ac781ae175ded77c
SHA1

1b0b4042e1e3766edc14a0cb5eda77327f2cdd2c
SHA256

41720887d7087390da6dac394ef3f30fe2f12c97352bd00401b2aa80f7c34c1f
SHA512

8f461b451301c9839c63769e0512c08bc83b9818a4a21dad2ebaf656567ac0d0ef6524027dde89c2e6675b6855b3b3bff9134f891198751653a0450cfa10ac6e
SSDEEP

768:ib6hioFi3qFvX+uaJWyadmMYDH8B85W2Fb96dBA9lzvYgZB+o:LgGiyuuaJMdmMYDo85Wkb96dBAfzbb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2000	1936	41720887d7087390da6dac394ef3f30fe2f12c97352bd00401b2aa80f7c34c1f.exe	29
PID 1936 wrote to memory of 2000	1936	41720887d7087390da6dac394ef3f30fe2f12c97352bd00401b2aa80f7c34c1f.exe	29
PID 1936 wrote to memory of 2000	1936	41720887d7087390da6dac394ef3f30fe2f12c97352bd00401b2aa80f7c34c1f.exe	29

C:\Users\Admin\AppData\Local\Temp\41720887d7087390da6dac394ef3f30fe2f12c97352bd00401b2aa80f7c34c1f.exe
"C:\Users\Admin\AppData\Local\Temp\41720887d7087390da6dac394ef3f30fe2f12c97352bd00401b2aa80f7c34c1f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1936 -s 36
  2⤵
  PID:2000

memory/1936-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download