1e848b50a2c3344b77b89c3b4b33517a665b140495a18bdb8f34595652ee8b97

Analysis

max time kernel
12s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 02:42

Target

ref/Avatar PSN Tools.exe
Size

7KB
MD5

84865470ecc1b1d3922d8e6619ac0912
SHA1

0d45e0cc8453d27384c10928a743299e6fadec37
SHA256

db487e1f264f4d3ff983b79e6fd5dc22b1a567a6865ae9f557e075350bf8169f
SHA512

4da8b3e671e080c515eb0b08161dbb8729a96b277473d3c033d5002490f0f66d001ecb3771ae0431efa8b942f8a588c7d3bf3f9d804de7fe50c198cb096bf2c9
SSDEEP

96:wsEIYyvvmJO1gAktFrXPwLNnizJrFIdnlhXupzSiT8xixuVxKwxxYxOzNt:aI3mJOSAktFrXPKN+J+dLvg6fx6m

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Avatar PSN Tools.exe

description	pid	process	target process
PID 2472 wrote to memory of 1512	2472	Avatar PSN Tools.exe	WerFault.exe
PID 2472 wrote to memory of 1512	2472	Avatar PSN Tools.exe	WerFault.exe
PID 2472 wrote to memory of 1512	2472	Avatar PSN Tools.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ref\Avatar PSN Tools.exe
"C:\Users\Admin\AppData\Local\Temp\ref\Avatar PSN Tools.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2472

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2472 -s 476
2⤵
PID:1512

memory/2472-0-0x000007FEF6323000-0x000007FEF6324000-memory.dmp

Filesize
4KB

Download
memory/2472-1-0x0000000000200000-0x000000000020A000-memory.dmp

Filesize
40KB

Download