811dbefc20a0a348038ef8f6adc70c38f9b778c20abfb85953a26dc6037a0cde

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-06-2024 03:31

Target

62460105edf1636fd9605894deba01a417fcd8558c9a43ceefbf9fdda536a9c1.exe
Size

1.4MB
MD5

d357d6c05936c8eb6dd5bea8ac7c251e
SHA1

34680347e1bd884e50c279ef18a861a2067b7482
SHA256

62460105edf1636fd9605894deba01a417fcd8558c9a43ceefbf9fdda536a9c1
SHA512

4d90f5e274f66dc223c7d55ab2997fb217861fe4b8a683c03d3f46b767dfb4c3463cb9a62aeacef6527d3ea7f1699a5952659415eff4d7f3bdac48c0d3b2ef6c
SSDEEP

24576:tfPEX8SkcR5uPze7dH1ZkivEdLeC+fJCHLQo3u5aUC6/wA4oAH:hPEX8StRX1ZkGpCqd5a76oA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2012	2928	62460105edf1636fd9605894deba01a417fcd8558c9a43ceefbf9fdda536a9c1.exe	28
PID 2928 wrote to memory of 2012	2928	62460105edf1636fd9605894deba01a417fcd8558c9a43ceefbf9fdda536a9c1.exe	28
PID 2928 wrote to memory of 2012	2928	62460105edf1636fd9605894deba01a417fcd8558c9a43ceefbf9fdda536a9c1.exe	28

C:\Users\Admin\AppData\Local\Temp\62460105edf1636fd9605894deba01a417fcd8558c9a43ceefbf9fdda536a9c1.exe
"C:\Users\Admin\AppData\Local\Temp\62460105edf1636fd9605894deba01a417fcd8558c9a43ceefbf9fdda536a9c1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2928 -s 196
  2⤵
  PID:2012