3d3c1a44e0ba95c13717557f65bda9aeb3078e875243fd9a94bedc416de2b2fd

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 08:09

Target

114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe
Size

1.2MB
MD5

ef95411945330db1907508d38bc373ac
SHA1

7bb8d57cb26f3927bd741db598254efd72f249c4
SHA256

114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323
SHA512

2ca5709cae5f19b9e95b80df91d00cdc81522f41c5be7070434df8edb25f80f4c1d1704f8db7824f6cae0bb81e4cd1c987d58749a56853a1a5da65542ab2bc8c
SSDEEP

24576:snz6dSHy7DXstIVWn4etKUBYWPezgW8Ns:8zf5N4qKUGWP9W8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe

description	pid	process	target process
PID 2340 wrote to memory of 2724	2340	114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe	WerFault.exe
PID 2340 wrote to memory of 2724	2340	114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe	WerFault.exe
PID 2340 wrote to memory of 2724	2340	114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe
"C:\Users\Admin\AppData\Local\Temp\114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2340 -s 1260
  2⤵
  PID:2724