307a8fb1b3b1310b68ab2517eba179038efc66b96e39d9ccd35123b808cd1d77

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 01:05

Target

307a8fb1b3b1310b68ab2517eba179038efc66b96e39d9ccd35123b808cd1d77.exe
Size

9.9MB
MD5

f3e7e8bea42173c3763832ede0d14370
SHA1

d3696818491859396fef49fc0ee104ecab2c377d
SHA256

307a8fb1b3b1310b68ab2517eba179038efc66b96e39d9ccd35123b808cd1d77
SHA512

a81908fe242426d4390728661a59a9eded1f9ef24d85911ca563c2f89865efd49dc327cbf4e42803e68044ece568b6015087c5aa1707baf15abb05804300afbf
SSDEEP

196608:enduJuOi4EEeN8wxkxS6ZIau1vObako/elVceaklwgaKyXJIUd/nu:enAJMnXNqxS6ZI6b56eTcDkFQJIU5nu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2176	1656	307a8fb1b3b1310b68ab2517eba179038efc66b96e39d9ccd35123b808cd1d77.exe	30
PID 1656 wrote to memory of 2176	1656	307a8fb1b3b1310b68ab2517eba179038efc66b96e39d9ccd35123b808cd1d77.exe	30
PID 1656 wrote to memory of 2176	1656	307a8fb1b3b1310b68ab2517eba179038efc66b96e39d9ccd35123b808cd1d77.exe	30

C:\Users\Admin\AppData\Local\Temp\307a8fb1b3b1310b68ab2517eba179038efc66b96e39d9ccd35123b808cd1d77.exe
"C:\Users\Admin\AppData\Local\Temp\307a8fb1b3b1310b68ab2517eba179038efc66b96e39d9ccd35123b808cd1d77.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1656 -s 504
  2⤵
  PID:2176

memory/1656-0-0x000007FEF67B3000-0x000007FEF67B4000-memory.dmp

Filesize
4KB

Download
memory/1656-1-0x00000000002C0000-0x0000000000CA0000-memory.dmp

Filesize
9.9MB

Download
memory/1656-2-0x000007FEF67B3000-0x000007FEF67B4000-memory.dmp

Filesize
4KB

Download