984d530e78ec72391f217805e5e078cef1c4e15c156c12d60841dae8b2e5af87

Resubmissions

02/08/2024, 02:50

02/08/2024, 02:47

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 02:50

Target

x86/DirectoryMonitor_[1MB]_[1].exe
Size

1.9MB
MD5

76067380db217854920c9652e6276ae1
SHA1

10442a38db18218953418b84bb8684a3fa399312
SHA256

d74373f86c366409db3392258b552e35477ffd47d968d094abad170663193fc6
SHA512

91a42d2196b42515132ccdbc40dec46396995d80da5a44eded2d16fe4350c50a68a2556a80acdccef823bc233b4fa5a88a6423748e9fea2e23795339795857f9
SSDEEP

12288:hc6VJx4LOQyQLkoCPs+b4H4APA60jEcflSIQZXDVrZLpYHT:hhJxPQySCod3c8pZzhnYHT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 1320	2096	DirectoryMonitor_[1MB]_[1].exe	30
PID 2096 wrote to memory of 1320	2096	DirectoryMonitor_[1MB]_[1].exe	30
PID 2096 wrote to memory of 1320	2096	DirectoryMonitor_[1MB]_[1].exe	30

C:\Users\Admin\AppData\Local\Temp\x86\DirectoryMonitor_[1MB]_[1].exe
"C:\Users\Admin\AppData\Local\Temp\x86\DirectoryMonitor_[1MB]_[1].exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2096 -s 528
  2⤵
  PID:1320

memory/2096-0-0x000007FEF5443000-0x000007FEF5444000-memory.dmp

Filesize
4KB

Download
memory/2096-1-0x0000000001320000-0x0000000001510000-memory.dmp

Filesize
1.9MB

Download
memory/2096-2-0x000007FEF5443000-0x000007FEF5444000-memory.dmp

Filesize
4KB

Download