67d31a6ccbd4ec8d0daac69fcfcaa27caa4d846a4bb16fa42f1553f5210e946a

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
01-09-2024 03:11

Target

67d31a6ccbd4ec8d0daac69fcfcaa27caa4d846a4bb16fa42f1553f5210e946a.exe
Size

2.4MB
MD5

72c76f010b745382049c66d9d0fb60a1
SHA1

ad3ee3195fca324b87b9564e3d10641ee4d72e67
SHA256

67d31a6ccbd4ec8d0daac69fcfcaa27caa4d846a4bb16fa42f1553f5210e946a
SHA512

70be32b946fd95731d46875adaad2b57afe006ca7cb4473b4619c448d22c4d388ff6f6016cf292dbfd86e99a7425a202d083550c5455e9f93581e46f42bdb939
SSDEEP

24576:HoTL3+lsXpBdKTcLWiU1Rd4oMBCnxbLrV2LrVZZci7q510QfyQKPzgYjX6:sXpBEcLWiU12ciuWt6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2756	2252	67d31a6ccbd4ec8d0daac69fcfcaa27caa4d846a4bb16fa42f1553f5210e946a.exe	30
PID 2252 wrote to memory of 2756	2252	67d31a6ccbd4ec8d0daac69fcfcaa27caa4d846a4bb16fa42f1553f5210e946a.exe	30
PID 2252 wrote to memory of 2756	2252	67d31a6ccbd4ec8d0daac69fcfcaa27caa4d846a4bb16fa42f1553f5210e946a.exe	30

C:\Users\Admin\AppData\Local\Temp\67d31a6ccbd4ec8d0daac69fcfcaa27caa4d846a4bb16fa42f1553f5210e946a.exe
"C:\Users\Admin\AppData\Local\Temp\67d31a6ccbd4ec8d0daac69fcfcaa27caa4d846a4bb16fa42f1553f5210e946a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2252 -s 532
  2⤵
  PID:2756

memory/2252-0-0x000007FEF58F3000-0x000007FEF58F4000-memory.dmp

Filesize
4KB

Download
memory/2252-1-0x000000013FB90000-0x000000013FDFE000-memory.dmp

Filesize
2.4MB

Download
memory/2252-2-0x000007FEF58F3000-0x000007FEF58F4000-memory.dmp

Filesize
4KB

Download