440b8b2951e94587c4da806df96a00eda98ef6336effc7916e61e577132e60ab

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 19:08

Target

CeleryApp.exe
Size

8.8MB
MD5

74c366b46a85acac6c83e9671e64dda7
SHA1

dc9a7b4cc7511b701401aa86e0106d3495e3a0fe
SHA256

6a25cc6c05e54ca56e8b51d2b2bd8b9a17a96ecb1d1f6d4442d36378dc809ed1
SHA512

e0df64a74c3c9e1c36f5957d346d961cc92741b1803e05d41454dde4371a0e9420f9e79163bed9fe2d8b588b9da6f2faaa08003ca50be37a6425a8320acd15cb
SSDEEP

98304:wEgLIRfyC7egWJ3iJzdjf4fwraOWcD9XdMPABIw/t6KHDicVwzUs7:wEguhegD4fJOWs9XNBZ16M2cuU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 2852	1072	CeleryApp.exe	30
PID 1072 wrote to memory of 2852	1072	CeleryApp.exe	30
PID 1072 wrote to memory of 2852	1072	CeleryApp.exe	30

C:\Users\Admin\AppData\Local\Temp\CeleryApp.exe
"C:\Users\Admin\AppData\Local\Temp\CeleryApp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1072 -s 864
  2⤵
  PID:2852

memory/1072-0-0x000007FEF60E3000-0x000007FEF60E4000-memory.dmp

Filesize
4KB

Download
memory/1072-1-0x00000000012A0000-0x0000000001B66000-memory.dmp

Filesize
8.8MB

Download
memory/1072-2-0x000007FEF60E0000-0x000007FEF6ACC000-memory.dmp

Filesize
9.9MB

Download
memory/1072-3-0x0000000000850000-0x0000000000890000-memory.dmp

Filesize
256KB

Download
memory/1072-4-0x0000000000D60000-0x0000000000DB0000-memory.dmp

Filesize
320KB

Download
memory/1072-5-0x000000001DE50000-0x000000001E76E000-memory.dmp

Filesize
9.1MB

Download
memory/1072-7-0x0000000000560000-0x000000000056A000-memory.dmp

Filesize
40KB

Download
memory/1072-6-0x0000000000560000-0x000000000056A000-memory.dmp

Filesize
40KB

Download
memory/1072-8-0x0000000000560000-0x000000000056E000-memory.dmp

Filesize
56KB

Download
memory/1072-9-0x0000000001100000-0x0000000001174000-memory.dmp

Filesize
464KB

Download
memory/1072-10-0x000007FEF60E3000-0x000007FEF60E4000-memory.dmp

Filesize
4KB

Download
memory/1072-11-0x000007FEF60E0000-0x000007FEF6ACC000-memory.dmp

Filesize
9.9MB

Download
memory/1072-13-0x0000000000560000-0x000000000056A000-memory.dmp

Filesize
40KB

Download
memory/1072-12-0x0000000000560000-0x000000000056A000-memory.dmp

Filesize
40KB

Download
memory/1072-14-0x000007FEF60E0000-0x000007FEF6ACC000-memory.dmp

Filesize
9.9MB

Download