39bbfa3df480d234a63098297063d1932494537ec872d2986ae2931347d34227

Analysis

max time kernel
23s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25-07-2024 20:32

Target

39bbfa3df480d234a63098297063d1932494537ec872d2986ae2931347d34227.exe
Size

1.4MB
MD5

1fd0c4a53b69b712d2721eee1123cc67
SHA1

349694c541549ffec6eaf60dbf272b4128751374
SHA256

39bbfa3df480d234a63098297063d1932494537ec872d2986ae2931347d34227
SHA512

b82bd6e8e9d2852805743ce1ef554e5e41c5af416dd64edab0474bc39cf2dec7e3bdb2f977e9600d2ca3fd0b9d47137fd234c40319e587d1450e7bb97b80c3e1
SSDEEP

24576:3LuBbfX+aexYAkWmUrmRzflsiLDHAm9A5HewP9:36R2iLvaeo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 1852	448	39bbfa3df480d234a63098297063d1932494537ec872d2986ae2931347d34227.exe	30
PID 448 wrote to memory of 1852	448	39bbfa3df480d234a63098297063d1932494537ec872d2986ae2931347d34227.exe	30
PID 448 wrote to memory of 1852	448	39bbfa3df480d234a63098297063d1932494537ec872d2986ae2931347d34227.exe	30

C:\Users\Admin\AppData\Local\Temp\39bbfa3df480d234a63098297063d1932494537ec872d2986ae2931347d34227.exe
"C:\Users\Admin\AppData\Local\Temp\39bbfa3df480d234a63098297063d1932494537ec872d2986ae2931347d34227.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:448
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 448 -s 496
  2⤵
  PID:1852

memory/448-1-0x0000000000250000-0x00000000003BE000-memory.dmp

Filesize
1.4MB

Download
memory/448-0-0x000007FEF5713000-0x000007FEF5714000-memory.dmp

Filesize
4KB

Download
memory/448-2-0x000007FEF5713000-0x000007FEF5714000-memory.dmp

Filesize
4KB

Download