4a869ee6fa2c9e48cd6b38efa090a2320c393861fd6b1060b91fdc81c0899ee0

Analysis

max time kernel
142s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 16:12

Target

4a869ee6fa2c9e48cd6b38efa090a2320c393861fd6b1060b91fdc81c0899ee0.exe
Size

746KB
MD5

bdc570243d208165f5779471fe2c5021
SHA1

1fc38dd8043c3e5bee85434160657898c0861072
SHA256

4a869ee6fa2c9e48cd6b38efa090a2320c393861fd6b1060b91fdc81c0899ee0
SHA512

4739a9b491a689757c11cd3e5c59275518183be6165043606257d82a73baa91918f895263feedef94ea425cd6de3f5847354f0a4cc7f859e8ffd94f5ab7404ec
SSDEEP

6144:ecrdE8Ks6AQ+PIqGO0kaHAtKHWlVnMXugPkazbqBJWckoC0ryqj90+p6q:ltn6ARP9GOcTWlIy+knkoiqKc6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 3060	1356	4a869ee6fa2c9e48cd6b38efa090a2320c393861fd6b1060b91fdc81c0899ee0.exe	30
PID 1356 wrote to memory of 3060	1356	4a869ee6fa2c9e48cd6b38efa090a2320c393861fd6b1060b91fdc81c0899ee0.exe	30
PID 1356 wrote to memory of 3060	1356	4a869ee6fa2c9e48cd6b38efa090a2320c393861fd6b1060b91fdc81c0899ee0.exe	30

C:\Users\Admin\AppData\Local\Temp\4a869ee6fa2c9e48cd6b38efa090a2320c393861fd6b1060b91fdc81c0899ee0.exe
"C:\Users\Admin\AppData\Local\Temp\4a869ee6fa2c9e48cd6b38efa090a2320c393861fd6b1060b91fdc81c0899ee0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1356 -s 56
  2⤵
  PID:3060

memory/1356-0-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download