b5b9671a6e309afd15a595ca96ce2d294f26519c73e68c4909418a3129c6db68

Analysis

max time kernel
17s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 04:53

Target

LosslessScaling.exe
Size

962KB
MD5

4c8d9566dc1e5f1eae914a546ee819a0
SHA1

8b16f43b0c84a43eecb24aad51d33795752a3b07
SHA256

b5b9671a6e309afd15a595ca96ce2d294f26519c73e68c4909418a3129c6db68
SHA512

5a7ded63ec2c6d3320d14bdc876c4f51c1a7c6e1c8a89028f646c03a2b393262db3b16d66b58903a83f0aa34218a8649aeeec0cf49a0ac9a404d29336bf85532
SSDEEP

12288:ixNRPEDS4MCLSyf6mOuGyW38yHJc+CKtOaO5Z7WhaGwnzE4ZbuRCwmhI2J+0sDw8:irRWtMCLPf1Oi32OvzTo4ZiRlT/vl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2412	2696	LosslessScaling.exe	30
PID 2696 wrote to memory of 2412	2696	LosslessScaling.exe	30
PID 2696 wrote to memory of 2412	2696	LosslessScaling.exe	30

C:\Users\Admin\AppData\Local\Temp\LosslessScaling.exe
"C:\Users\Admin\AppData\Local\Temp\LosslessScaling.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2696 -s 644
  2⤵
  PID:2412

memory/2696-0-0x000007FEF5803000-0x000007FEF5804000-memory.dmp

Filesize
4KB

Download
memory/2696-1-0x0000000000C40000-0x0000000000D36000-memory.dmp

Filesize
984KB

Download
memory/2696-2-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

Filesize
9.9MB

Download
memory/2696-3-0x000000001AE10000-0x000000001AEF6000-memory.dmp

Filesize
920KB

Download
memory/2696-4-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

Filesize
9.9MB

Download