114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
27-07-2024 09:11

Target

114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe
Size

1.2MB
MD5

ef95411945330db1907508d38bc373ac
SHA1

7bb8d57cb26f3927bd741db598254efd72f249c4
SHA256

114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323
SHA512

2ca5709cae5f19b9e95b80df91d00cdc81522f41c5be7070434df8edb25f80f4c1d1704f8db7824f6cae0bb81e4cd1c987d58749a56853a1a5da65542ab2bc8c
SSDEEP

24576:snz6dSHy7DXstIVWn4etKUBYWPezgW8Ns:8zf5N4qKUGWP9W8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe

description	pid	process	target process
PID 3032 wrote to memory of 2928	3032	114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe	WerFault.exe
PID 3032 wrote to memory of 2928	3032	114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe	WerFault.exe
PID 3032 wrote to memory of 2928	3032	114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe
"C:\Users\Admin\AppData\Local\Temp\114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3032 -s 1260
  2⤵
  PID:2928