614561f9e77dfc46e029ceeae9628f397c20a7387525f0c49271fff0204880e3

Analysis

max time kernel
23s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
03-08-2024 08:31

Target

74a3542ef5e4343770ed4933907893e0N.exe
Size

243KB
MD5

74a3542ef5e4343770ed4933907893e0
SHA1

1b554208ca1f4e9ef517aea6f2a9c3fbaa2b84c1
SHA256

614561f9e77dfc46e029ceeae9628f397c20a7387525f0c49271fff0204880e3
SHA512

ac4e97924b0da1e1a8a9281ae9a25d82ca8a4db7aa823eed7fe2c3aabe4e10cbd13a26ca2c0d3e3fd7023e988cb788267ac8dda54ce4cec7b1a6a29486cc0ec9
SSDEEP

3072:n6TJJzmAlH2fP49KLYDD4NewDKMz76RXqEeVmWdeid44wFIauYpIp78EbyRjTi6y:n6PH9KLyKMSNeiZwRgl8EbEniy

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

74a3542ef5e4343770ed4933907893e0N.exe

description	pid	process	target process
PID 2368 wrote to memory of 2684	2368	74a3542ef5e4343770ed4933907893e0N.exe	WerFault.exe
PID 2368 wrote to memory of 2684	2368	74a3542ef5e4343770ed4933907893e0N.exe	WerFault.exe
PID 2368 wrote to memory of 2684	2368	74a3542ef5e4343770ed4933907893e0N.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\74a3542ef5e4343770ed4933907893e0N.exe
"C:\Users\Admin\AppData\Local\Temp\74a3542ef5e4343770ed4933907893e0N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2368

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2368 -s 476
2⤵
PID:2684

memory/2368-0-0x000007FEF6393000-0x000007FEF6394000-memory.dmp

Filesize
4KB

Download
memory/2368-1-0x0000000000370000-0x00000000003B4000-memory.dmp

Filesize
272KB

Download
memory/2368-2-0x000007FEF6393000-0x000007FEF6394000-memory.dmp

Filesize
4KB

Download