1977989e0bce67931c2cdde0d9db0006d70428cfbfe46c4948c92d062266c33f

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 08:15

Target

ae6b146745774e48ddc480ee7edf5c40N.exe
Size

4.4MB
MD5

ae6b146745774e48ddc480ee7edf5c40
SHA1

4c6934f9da2b37d9c9c1a270855e9b2438bb3b9a
SHA256

1977989e0bce67931c2cdde0d9db0006d70428cfbfe46c4948c92d062266c33f
SHA512

eff13d648395d030ba357d1020108ce6d69f4f42d5bfe574c347d3d255b88bab1c635ac69765df7a9b99c32d6971944d548f7de3781e45f5391fbd96aa492bd2
SSDEEP

49152:tVyIn2PUgkxxn2sfCKTAX9Bm5/DASMabUKvbuwlyDyThUBkz0MTYsH4:tc7kxxn2sfHTAnm57VlUY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2760	2128	ae6b146745774e48ddc480ee7edf5c40N.exe	30
PID 2128 wrote to memory of 2760	2128	ae6b146745774e48ddc480ee7edf5c40N.exe	30
PID 2128 wrote to memory of 2760	2128	ae6b146745774e48ddc480ee7edf5c40N.exe	30

C:\Users\Admin\AppData\Local\Temp\ae6b146745774e48ddc480ee7edf5c40N.exe
"C:\Users\Admin\AppData\Local\Temp\ae6b146745774e48ddc480ee7edf5c40N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2128 -s 528
  2⤵
  PID:2760

memory/2128-0-0x000007FEF5573000-0x000007FEF5574000-memory.dmp

Filesize
4KB

Download
memory/2128-1-0x000000013F140000-0x000000013F5A2000-memory.dmp

Filesize
4.4MB

Download
memory/2128-2-0x000007FEF5573000-0x000007FEF5574000-memory.dmp

Filesize
4KB

Download