7643f989a6b22411ac72a4c17ae5ddee007440bd794d1d3be416bb5b45b53f9b

Analysis

max time kernel
25s
max time network
19s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
06-08-2024 06:57

Target

CeleryApp.exe
Size

8.8MB
MD5

74c366b46a85acac6c83e9671e64dda7
SHA1

dc9a7b4cc7511b701401aa86e0106d3495e3a0fe
SHA256

6a25cc6c05e54ca56e8b51d2b2bd8b9a17a96ecb1d1f6d4442d36378dc809ed1
SHA512

e0df64a74c3c9e1c36f5957d346d961cc92741b1803e05d41454dde4371a0e9420f9e79163bed9fe2d8b588b9da6f2faaa08003ca50be37a6425a8320acd15cb
SSDEEP

98304:wEgLIRfyC7egWJ3iJzdjf4fwraOWcD9XdMPABIw/t6KHDicVwzUs7:wEguhegD4fJOWs9XNBZ16M2cuU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2408	2528	CeleryApp.exe	29
PID 2528 wrote to memory of 2408	2528	CeleryApp.exe	29
PID 2528 wrote to memory of 2408	2528	CeleryApp.exe	29

C:\Users\Admin\AppData\Local\Temp\CeleryApp.exe
"C:\Users\Admin\AppData\Local\Temp\CeleryApp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2528 -s 860
  2⤵
  PID:2408

memory/2528-0-0x000007FEF5E93000-0x000007FEF5E94000-memory.dmp

Filesize
4KB

Download
memory/2528-1-0x0000000000FA0000-0x0000000001866000-memory.dmp

Filesize
8.8MB

Download
memory/2528-2-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/2528-3-0x0000000000550000-0x0000000000590000-memory.dmp

Filesize
256KB

Download
memory/2528-4-0x0000000000970000-0x00000000009C0000-memory.dmp

Filesize
320KB

Download
memory/2528-5-0x000000001D870000-0x000000001E18E000-memory.dmp

Filesize
9.1MB

Download
memory/2528-7-0x0000000000710000-0x000000000071A000-memory.dmp

Filesize
40KB

Download
memory/2528-6-0x0000000000710000-0x000000000071A000-memory.dmp

Filesize
40KB

Download
memory/2528-8-0x0000000000710000-0x000000000071E000-memory.dmp

Filesize
56KB

Download
memory/2528-9-0x0000000000F00000-0x0000000000F74000-memory.dmp

Filesize
464KB

Download
memory/2528-10-0x000007FEF5E93000-0x000007FEF5E94000-memory.dmp

Filesize
4KB

Download
memory/2528-11-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/2528-12-0x0000000000710000-0x000000000071A000-memory.dmp

Filesize
40KB

Download
memory/2528-13-0x0000000000710000-0x000000000071A000-memory.dmp

Filesize
40KB

Download