0aeaf8afee14d5be2425ed7826c7895b1c318397ab7f3bb1523a9b62061c1ef8

Resubmissions

11-10-2024 07:00

07-08-2024 08:37

07-08-2024 08:30

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07-08-2024 08:30

Target

643dde3f461907a94f145b3cd8fe37dbad63aec85a4e5ed759fe843b9214a8d2.exe
Size

2.1MB
MD5

0468a32ad1ed1169e98b897d87f51164
SHA1

0d9dc54a5f91e6ed7d324c2a65b152a168d57b08
SHA256

643dde3f461907a94f145b3cd8fe37dbad63aec85a4e5ed759fe843b9214a8d2
SHA512

7deb90629608f3a227e96d948bbb4c78ad21e1eb659bfdab903d4f25bdb1e6c8af7edec9604274aa745dd90f8253e48fbccf661f2bc2b6609e5b8807645750ca
SSDEEP

24576:GQZEhAybJ37KtuUZ786qGbAJYhIRKPS0dJDhrI4ufnLVVx90e+7ym:WAC3a78sIRSGVV8V5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2284	2476	643dde3f461907a94f145b3cd8fe37dbad63aec85a4e5ed759fe843b9214a8d2.exe	30
PID 2476 wrote to memory of 2284	2476	643dde3f461907a94f145b3cd8fe37dbad63aec85a4e5ed759fe843b9214a8d2.exe	30
PID 2476 wrote to memory of 2284	2476	643dde3f461907a94f145b3cd8fe37dbad63aec85a4e5ed759fe843b9214a8d2.exe	30

C:\Users\Admin\AppData\Local\Temp\643dde3f461907a94f145b3cd8fe37dbad63aec85a4e5ed759fe843b9214a8d2.exe
"C:\Users\Admin\AppData\Local\Temp\643dde3f461907a94f145b3cd8fe37dbad63aec85a4e5ed759fe843b9214a8d2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2476 -s 152
  2⤵
  PID:2284