5f6cf1ffef45a3c6e0df9064f737dd8ce77dcbc546055ba3ae44b2be8d91b8cb

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25-07-2024 08:39

Target

a92c985e6a1e1cd56e866d7198c895a0N.exe
Size

731KB
MD5

a92c985e6a1e1cd56e866d7198c895a0
SHA1

223caeccc56a3baee3e31b114886d4497ea6fe80
SHA256

5f6cf1ffef45a3c6e0df9064f737dd8ce77dcbc546055ba3ae44b2be8d91b8cb
SHA512

3b60238e868de93512a3759174434e67f5ced1d167fe73e389cdf6e8a0736dcfc282751e2dac0cc9806c0c92189b45dba27ab8ca538a4ae4b5e3382e706a7f50
SSDEEP

6144:Fp19SmYRZbsuSBs3ojpe6aABlwZFsr5pOGJr3eRqk3tJc+xZRtiKzvzaOKIeM87e:Fp1EPZbsu2s3ojpe6aeSg3DeRqkUWh

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a92c985e6a1e1cd56e866d7198c895a0N.exe

description	pid	process	target process
PID 2956 wrote to memory of 1692	2956	a92c985e6a1e1cd56e866d7198c895a0N.exe	WerFault.exe
PID 2956 wrote to memory of 1692	2956	a92c985e6a1e1cd56e866d7198c895a0N.exe	WerFault.exe
PID 2956 wrote to memory of 1692	2956	a92c985e6a1e1cd56e866d7198c895a0N.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a92c985e6a1e1cd56e866d7198c895a0N.exe
"C:\Users\Admin\AppData\Local\Temp\a92c985e6a1e1cd56e866d7198c895a0N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2956 -s 76
2⤵
PID:1692