01bc5eb7167e5520623d6d4e51ff54b84dcc84f1a33d0c591ec77a5492112223

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 01:30

Target

01bc5eb7167e5520623d6d4e51ff54b84dcc84f1a33d0c591ec77a5492112223.exe
Size

17KB
MD5

a2fba519be11f43f2cda8ca5fe6d3ca4
SHA1

09a6d616be2bc1a61ab5fa91e448df1507e00b9a
SHA256

01bc5eb7167e5520623d6d4e51ff54b84dcc84f1a33d0c591ec77a5492112223
SHA512

99f9a1d9c095947fe48ba0fec29c8570e4aaa950a7187c200e70442ab433170c54a063ab332673ff8b547d257a45c7b1ddd91d20f56daff4c9fa7953ee4491dc
SSDEEP

384:n/axEe3m6c2LNyb8E9VF6IYinAM+oo3qOE:n/8t35tHEpYinAMx/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2396	2212	01bc5eb7167e5520623d6d4e51ff54b84dcc84f1a33d0c591ec77a5492112223.exe	29
PID 2212 wrote to memory of 2396	2212	01bc5eb7167e5520623d6d4e51ff54b84dcc84f1a33d0c591ec77a5492112223.exe	29
PID 2212 wrote to memory of 2396	2212	01bc5eb7167e5520623d6d4e51ff54b84dcc84f1a33d0c591ec77a5492112223.exe	29

C:\Users\Admin\AppData\Local\Temp\01bc5eb7167e5520623d6d4e51ff54b84dcc84f1a33d0c591ec77a5492112223.exe
"C:\Users\Admin\AppData\Local\Temp\01bc5eb7167e5520623d6d4e51ff54b84dcc84f1a33d0c591ec77a5492112223.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2212 -s 492
  2⤵
  PID:2396

memory/2212-0-0x000007FEF5783000-0x000007FEF5784000-memory.dmp

Filesize
4KB

Download
memory/2212-1-0x0000000000C60000-0x0000000000C66000-memory.dmp

Filesize
24KB

Download
memory/2212-2-0x000007FEF5783000-0x000007FEF5784000-memory.dmp

Filesize
4KB

Download