fe0f54c271c3e45ca11e05b597de2cdfa6c1bc85589233c3e21b14bb7424f290

Resubmissions

22-08-2024 16:26

21-08-2024 12:58

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-08-2024 16:26

Target

600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe
Size

331KB
MD5

63b427f3875eaf7475491877a49f71c5
SHA1

8d6a1d3ce30eec4284cc3303fdf12a22a12f2a82
SHA256

600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1
SHA512

c9ee7f62f028aafe4a2753e50c61a1ae25816d586f6eb080d6ff20be0f7d27f8b5b384ad473625042e76b2e708cf0407e52d8a6fda5c9f1ffc0caf40a4636a3c
SSDEEP

6144:eEjIabdDyAnk2S5dE1hQqX9lecEEMH9O1BNI:eAIabd7nkc1h9X9Mo7I

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 1852	2520	600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe	31
PID 2520 wrote to memory of 1852	2520	600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe	31
PID 2520 wrote to memory of 1852	2520	600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe	31

C:\Users\Admin\AppData\Local\Temp\600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe
"C:\Users\Admin\AppData\Local\Temp\600ea8be786d5acc5fa71c8dd19297049a4e9f1fe6a597c2ebcc9785acd8bdd1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2520 -s 32
  2⤵
  PID:1852