2b0cc5064e5287b8ef3320016f2dc61d413bef95ccaa686144c0d93245eb8f31

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
07/07/2024, 18:09

Target

silence.exe
Size

2.9MB
MD5

b5ea0ac589dc5d6e2ba4238d5ee33f29
SHA1

a1b0fd11c377eb7b6c4d4a9c9a93ab787299505b
SHA256

2b0cc5064e5287b8ef3320016f2dc61d413bef95ccaa686144c0d93245eb8f31
SHA512

517bb8ca2e10d45fe78be5ad8b1a493af9e41d3f3fe3a3285b9ac50e0a517267a49007aa1514e98458bf026820581121c453c938faacea57aa7469c158570eb5
SSDEEP

49152:S64gtSfI5Kz52IkAiffSwmzpGJJf1nklneC6Y4W+DXYEyOq3834X0IxHIW0yQXZb:SbggfI+52InwmzuklneC63W+DoVp38I2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2532	3032	silence.exe	31
PID 3032 wrote to memory of 2532	3032	silence.exe	31
PID 3032 wrote to memory of 2532	3032	silence.exe	31

C:\Users\Admin\AppData\Local\Temp\silence.exe
"C:\Users\Admin\AppData\Local\Temp\silence.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3032 -s 72
  2⤵
  PID:2532

memory/3032-0-0x000000013F350000-0x000000013F810000-memory.dmp

Filesize
4.8MB

Download
memory/3032-1-0x000000013F350000-0x000000013F810000-memory.dmp

Filesize
4.8MB

Download