81bc69a33b33949809d630e4fa5cdb89d8c60cf0783f447680c3677cae7bb9bb

Resubmissions

13-08-2024 12:03

01-08-2024 14:43

max time kernel
316s
max time network
316s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
13-08-2024 12:03

Target

EAYEEYZPFZ.exe
Size

367KB
MD5

e1a8ca0eb72cbdd2a372c69a355d42be
SHA1

3d52f700bdb8e35ecbdd4238c2c4ca34644c467e
SHA256

81bc69a33b33949809d630e4fa5cdb89d8c60cf0783f447680c3677cae7bb9bb
SHA512

5a52f994513cb35ea2dbe85a330753517620a1f2aaba01de7517792491ee480f1db06cd943b16a5f6e6837001e51a2e6fcf6d8e6939b81b9279a36359a3a08eb
SSDEEP

6144:nRCm0GL3QgsA1dXNXWzdLfDMAWuvXOvjdVrHC8ndKN3mZPRNQNgHBfkKV8:nRSGT71ddXsmAWiXOvH/KZmZjsgaK2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2068	1400	EAYEEYZPFZ.exe	29
PID 1400 wrote to memory of 2068	1400	EAYEEYZPFZ.exe	29
PID 1400 wrote to memory of 2068	1400	EAYEEYZPFZ.exe	29

C:\Users\Admin\AppData\Local\Temp\EAYEEYZPFZ.exe
"C:\Users\Admin\AppData\Local\Temp\EAYEEYZPFZ.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1400 -s 64
  2⤵
  PID:2068

memory/1400-0-0x000000007758C000-0x000000007758D000-memory.dmp

Filesize
4KB

Download