bd0922fd3ae7405d9141900936f258209973133769eb9cb8be7b1fbb34988718

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 01:23

Target

bd0922fd3ae7405d9141900936f258209973133769eb9cb8be7b1fbb34988718.exe
Size

10.1MB
MD5

b4f06bdbee8a1613874702bc53c44b64
SHA1

51d495a4c7931b35156d09a687d327791ed832a6
SHA256

bd0922fd3ae7405d9141900936f258209973133769eb9cb8be7b1fbb34988718
SHA512

5fc7336ba4dd566cc20cfe1c375e520654201b5d40d8ff9873c31a399d8c55c1bc79781da45127938475522ae9bfb394ef5eaad926ac3c9710e5317c385386bf
SSDEEP

196608:2QP0jBxUOUMixR5vTW1szQcHyo/aRGDJjguadEnHL6P3oZ4Y9Tjgrv0zDD7WY:2QWBpUnpvS1sz1nNDBVaSrkYZ4K3ev25

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2648	2632	bd0922fd3ae7405d9141900936f258209973133769eb9cb8be7b1fbb34988718.exe	30
PID 2632 wrote to memory of 2648	2632	bd0922fd3ae7405d9141900936f258209973133769eb9cb8be7b1fbb34988718.exe	30
PID 2632 wrote to memory of 2648	2632	bd0922fd3ae7405d9141900936f258209973133769eb9cb8be7b1fbb34988718.exe	30

C:\Users\Admin\AppData\Local\Temp\bd0922fd3ae7405d9141900936f258209973133769eb9cb8be7b1fbb34988718.exe
"C:\Users\Admin\AppData\Local\Temp\bd0922fd3ae7405d9141900936f258209973133769eb9cb8be7b1fbb34988718.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2632 -s 500
  2⤵
  PID:2648

memory/2632-0-0x000007FEF4EE3000-0x000007FEF4EE4000-memory.dmp

Filesize
4KB

Download
memory/2632-1-0x0000000000260000-0x0000000000C86000-memory.dmp

Filesize
10.1MB

Download
memory/2632-2-0x000007FEF4EE3000-0x000007FEF4EE4000-memory.dmp

Filesize
4KB

Download