f64088688b835fd536b3413be8e4a4ce987b772cf7557defb1f482f3da89967d

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 00:52

Target

f64088688b835fd536b3413be8e4a4ce987b772cf7557defb1f482f3da89967d.exe
Size

6KB
MD5

b09e3874be8d36b803cfe7dd7203a223
SHA1

61ff13f0b1209c5f2199d8994af8fe9a826a9871
SHA256

f64088688b835fd536b3413be8e4a4ce987b772cf7557defb1f482f3da89967d
SHA512

8d11fc6df51666aad68703788f068aee17dbecc77f94d49ea4cb872d84872e302ab8777246cdb9e1681e54205ab43a8e675739383984b58d71b710d028427154
SSDEEP

48:SPvbt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9ut:W0mIGnFc/38+N4ZHJWSY9FI5Wq3x

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1164	1656	f64088688b835fd536b3413be8e4a4ce987b772cf7557defb1f482f3da89967d.exe	29
PID 1656 wrote to memory of 1164	1656	f64088688b835fd536b3413be8e4a4ce987b772cf7557defb1f482f3da89967d.exe	29
PID 1656 wrote to memory of 1164	1656	f64088688b835fd536b3413be8e4a4ce987b772cf7557defb1f482f3da89967d.exe	29

C:\Users\Admin\AppData\Local\Temp\f64088688b835fd536b3413be8e4a4ce987b772cf7557defb1f482f3da89967d.exe
"C:\Users\Admin\AppData\Local\Temp\f64088688b835fd536b3413be8e4a4ce987b772cf7557defb1f482f3da89967d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1656 -s 32
  2⤵
  PID:1164