4acd4645740cff555bd5c7fdd8167a1ded999d4d5a0a6ad84fc5d998faa5c793

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-07-2024 13:22

Target

4acd4645740cff555bd5c7fdd8167a1ded999d4d5a0a6ad84fc5d998faa5c793.exe
Size

426KB
MD5

ba07b8206eb155c5f8dfe3cff5750861
SHA1

6e05876a4ab629879726f77c05c6ee8505262c49
SHA256

4acd4645740cff555bd5c7fdd8167a1ded999d4d5a0a6ad84fc5d998faa5c793
SHA512

e907e059ad6d6df06176badf98336d5da6f5e967dd4b25fe631b5832a17cf88e460565e3698f5a35fac5c3c20991b599b029732775509853f8f18929adce2073
SSDEEP

6144:8Z5f30291xuMHlpw9wrvwewMdBtbIbd5xv6P/6CuCNJ0hOY9:8nk291kMHlpw6r4eL3IbxvoyClwz9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4acd4645740cff555bd5c7fdd8167a1ded999d4d5a0a6ad84fc5d998faa5c793.exe

description	pid	process	target process
PID 3064 wrote to memory of 2084	3064	4acd4645740cff555bd5c7fdd8167a1ded999d4d5a0a6ad84fc5d998faa5c793.exe	WerFault.exe
PID 3064 wrote to memory of 2084	3064	4acd4645740cff555bd5c7fdd8167a1ded999d4d5a0a6ad84fc5d998faa5c793.exe	WerFault.exe
PID 3064 wrote to memory of 2084	3064	4acd4645740cff555bd5c7fdd8167a1ded999d4d5a0a6ad84fc5d998faa5c793.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4acd4645740cff555bd5c7fdd8167a1ded999d4d5a0a6ad84fc5d998faa5c793.exe
"C:\Users\Admin\AppData\Local\Temp\4acd4645740cff555bd5c7fdd8167a1ded999d4d5a0a6ad84fc5d998faa5c793.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3064

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3064 -s 76
2⤵
PID:2084