c8088020b4de7735eb3f55fc8cc4af3e58b6bfeaa03a67688c7d41cc255df6ef

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 01:57

Target

c8088020b4de7735eb3f55fc8cc4af3e58b6bfeaa03a67688c7d41cc255df6ef.exe
Size

101KB
MD5

b04619bbaf146daba860ab17fd54c19a
SHA1

326eb17c049d6c570c31dbd915d3f0c24463eaed
SHA256

c8088020b4de7735eb3f55fc8cc4af3e58b6bfeaa03a67688c7d41cc255df6ef
SHA512

aaba3ab7509fe8521fcba09c3249170602b9692db2205ec1a483c17f5616d7e172f6ac2680837098d99968f6d18ba6c7406c6a9a62633ee91612bdfa453be199
SSDEEP

768:C+hmVbyu31F9Vadv9Dvmz7enZ4uTI9I6RoLpgUelMZh:CVbyu37GdvxOzSnjI9FK6vlM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2800	1688	c8088020b4de7735eb3f55fc8cc4af3e58b6bfeaa03a67688c7d41cc255df6ef.exe	28
PID 1688 wrote to memory of 2800	1688	c8088020b4de7735eb3f55fc8cc4af3e58b6bfeaa03a67688c7d41cc255df6ef.exe	28
PID 1688 wrote to memory of 2800	1688	c8088020b4de7735eb3f55fc8cc4af3e58b6bfeaa03a67688c7d41cc255df6ef.exe	28

C:\Users\Admin\AppData\Local\Temp\c8088020b4de7735eb3f55fc8cc4af3e58b6bfeaa03a67688c7d41cc255df6ef.exe
"C:\Users\Admin\AppData\Local\Temp\c8088020b4de7735eb3f55fc8cc4af3e58b6bfeaa03a67688c7d41cc255df6ef.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1688 -s 532
  2⤵
  PID:2800

memory/1688-0-0x000007FEF6023000-0x000007FEF6024000-memory.dmp

Filesize
4KB

Download
memory/1688-1-0x0000000000860000-0x000000000087E000-memory.dmp

Filesize
120KB

Download
memory/1688-2-0x000007FEF6023000-0x000007FEF6024000-memory.dmp

Filesize
4KB

Download