81bc69a33b33949809d630e4fa5cdb89d8c60cf0783f447680c3677cae7bb9bb

Analysis

max time kernel
13s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 09:08

Target

81bc69a33b33949809d630e4fa5cdb89d8c60cf0783f447680c3677cae7bb9bb.exe
Size

367KB
MD5

e1a8ca0eb72cbdd2a372c69a355d42be
SHA1

3d52f700bdb8e35ecbdd4238c2c4ca34644c467e
SHA256

81bc69a33b33949809d630e4fa5cdb89d8c60cf0783f447680c3677cae7bb9bb
SHA512

5a52f994513cb35ea2dbe85a330753517620a1f2aaba01de7517792491ee480f1db06cd943b16a5f6e6837001e51a2e6fcf6d8e6939b81b9279a36359a3a08eb
SSDEEP

6144:nRCm0GL3QgsA1dXNXWzdLfDMAWuvXOvjdVrHC8ndKN3mZPRNQNgHBfkKV8:nRSGT71ddXsmAWiXOvH/KZmZjsgaK2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 2716	560	81bc69a33b33949809d630e4fa5cdb89d8c60cf0783f447680c3677cae7bb9bb.exe	29
PID 560 wrote to memory of 2716	560	81bc69a33b33949809d630e4fa5cdb89d8c60cf0783f447680c3677cae7bb9bb.exe	29
PID 560 wrote to memory of 2716	560	81bc69a33b33949809d630e4fa5cdb89d8c60cf0783f447680c3677cae7bb9bb.exe	29

C:\Users\Admin\AppData\Local\Temp\81bc69a33b33949809d630e4fa5cdb89d8c60cf0783f447680c3677cae7bb9bb.exe
"C:\Users\Admin\AppData\Local\Temp\81bc69a33b33949809d630e4fa5cdb89d8c60cf0783f447680c3677cae7bb9bb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 560 -s 64
  2⤵
  PID:2716

memory/560-0-0x00000000778CC000-0x00000000778CD000-memory.dmp

Filesize
4KB

Download