e7f3460a403107b6891fd2c3176191d843666165cd85ea2e0859d7e54a76e52b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 20:39

Target

e7f3460a403107b6891fd2c3176191d843666165cd85ea2e0859d7e54a76e52b.exe
Size

1.4MB
MD5

c76ca8fef8f9bea2b883f2a897b480e8
SHA1

dd965fa4e71b2abb4a2c1fb700cebf1ea10fe3a1
SHA256

e7f3460a403107b6891fd2c3176191d843666165cd85ea2e0859d7e54a76e52b
SHA512

c4eafb48f5595de08593b363dd985705254dd02edbd15ee0be9492fd6dbad92d91c50f47df7b9fd914e08804c0ff8b8aa8a43dff75d934321e1b35e04bef039c
SSDEEP

12288:0aKP6vKLwZl++N+bgIu8IC0H2K3OW9jljPTJ0K1c:5KP6vKLwZzN+bsLC0LL9jZ107

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2744	3052	e7f3460a403107b6891fd2c3176191d843666165cd85ea2e0859d7e54a76e52b.exe	30
PID 3052 wrote to memory of 2744	3052	e7f3460a403107b6891fd2c3176191d843666165cd85ea2e0859d7e54a76e52b.exe	30
PID 3052 wrote to memory of 2744	3052	e7f3460a403107b6891fd2c3176191d843666165cd85ea2e0859d7e54a76e52b.exe	30

C:\Users\Admin\AppData\Local\Temp\e7f3460a403107b6891fd2c3176191d843666165cd85ea2e0859d7e54a76e52b.exe
"C:\Users\Admin\AppData\Local\Temp\e7f3460a403107b6891fd2c3176191d843666165cd85ea2e0859d7e54a76e52b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3052 -s 536
  2⤵
  PID:2744

memory/3052-0-0x000007FEF4E83000-0x000007FEF4E84000-memory.dmp

Filesize
4KB

Download
memory/3052-1-0x00000000008E0000-0x0000000000A58000-memory.dmp

Filesize
1.5MB

Download
memory/3052-2-0x000007FEF4E80000-0x000007FEF586C000-memory.dmp

Filesize
9.9MB

Download
memory/3052-3-0x000007FEF4E83000-0x000007FEF4E84000-memory.dmp

Filesize
4KB

Download
memory/3052-4-0x000007FEF4E80000-0x000007FEF586C000-memory.dmp

Filesize
9.9MB

Download