a4f7b21dc88bdcf27cbe929d4bba979f759320b53f7e826bc0a77f55ebbf866c

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 01:58

Target
!ŞetUp_51286--#PaSꞨKḙy#$$/ErrorLog/DirectoryMonitor_[1MB]_[1].exe
Size 1.9MB
Sample240706-cd8y5asejp
SHA256 d74373f86c366409db3392258b552e35477ffd47d968d094abad170663193fc6
MD5 76067380db217854920c9652e6276ae1
SHA1 10442a38db18218953418b84bb8684a3fa399312
SHA512 91a42d2196b42515132ccdbc40dec46396995d80da5a44eded2d16fe4350c50a68a2556a80acdccef823bc233b4fa5a88a6423748e9fea2e23795339795857f9
SSDEEP 12288:hc6VJx4LOQyQLkoCPs+b4H4APA60jEcflSIQZXDVrZLpYHT:hhJxPQySCod3c8pZzhnYHT
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 1996	2908	DirectoryMonitor_[1MB]_[1].exe	30
PID 2908 wrote to memory of 1996	2908	DirectoryMonitor_[1MB]_[1].exe	30
PID 2908 wrote to memory of 1996	2908	DirectoryMonitor_[1MB]_[1].exe	30

C:\Users\Admin\AppData\Local\Temp\!ŞetUp_51286--#PaSꞨKḙy#$$\ErrorLog\DirectoryMonitor_[1MB]_[1].exe
"C:\Users\Admin\AppData\Local\Temp\!ŞetUp_51286--#PaSꞨKḙy#$$\ErrorLog\DirectoryMonitor_[1MB]_[1].exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2908 -s 532
  2⤵
  PID:1996

memory/2908-0-0x000007FEF5883000-0x000007FEF5884000-memory.dmp

Download

memory/2908-1-0x0000000000E50000-0x0000000001040000-memory.dmp

Download