d3ca102b990985518abf51ba8d71af250d10d9a017cfda853bbd71eafec3de0a

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 23:23

Target

Built/osint.exe
Size

61KB
MD5

eccdb3f0140458279adb0147f5596b1c
SHA1

b09938ab69ba6dd182adf28763f90259a5a8a15f
SHA256

9c6293f95054168d7e1925bd32f3430800a54b99d215af3461f054ef7103ff31
SHA512

1d2b2ee0259f0d2ee5345b96baee1d0cff378f5e630d804d8eb6faad68d82e21bd4b4c1c22bf6f4210f9724daadaa224147ae22cdb00163c10873e53ac06398d
SSDEEP

768:zBnP2ijO8/I/Ih5Fz3g6gYvQ8haqzQc0Vup3tjPPEXZnxPotQY16J10oiD4Jx3m8:4LIhjjrgejPPEJxLY1vozx39

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 1980	1860	osint.exe	28
PID 1860 wrote to memory of 1980	1860	osint.exe	28
PID 1860 wrote to memory of 1980	1860	osint.exe	28

C:\Users\Admin\AppData\Local\Temp\Built\osint.exe
"C:\Users\Admin\AppData\Local\Temp\Built\osint.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1860 -s 504
  2⤵
  PID:1980

memory/1860-0-0x000007FEF60C3000-0x000007FEF60C4000-memory.dmp

Filesize
4KB

Download
memory/1860-1-0x0000000000C00000-0x0000000000C16000-memory.dmp

Filesize
88KB

Download
memory/1860-2-0x000007FEF60C3000-0x000007FEF60C4000-memory.dmp

Filesize
4KB

Download