56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 06:12

Target

56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763.exe
Size

10.7MB
MD5

9fe22114dea040c36539ccb2e7c584ab
SHA1

3cbafd64e2ef11fb58ccda3161c53d7733acabf5
SHA256

56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763
SHA512

a5a15ed48ad2d602ad30c290a87112b6f6a0afa6664583c8a25ff95fd86101724c74f5e35b2da9b2217b3e243cf52675080e8a4cab2ed3ae77608b3bf03c392d
SSDEEP

196608:tKacfN+dCCaHz26u8l097GZbuTtDuVIJT5RRLmiX3mJpDlW:rTHx6j097GZbupmIJtREiX34l

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2288	2960	56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763.exe	31
PID 2960 wrote to memory of 2288	2960	56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763.exe	31
PID 2960 wrote to memory of 2288	2960	56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763.exe	31

C:\Users\Admin\AppData\Local\Temp\56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763.exe
"C:\Users\Admin\AppData\Local\Temp\56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2960 -s 32
  2⤵
  PID:2288