52b0ed0a352304adede2bfc6d269751f1e95580c006e4980ecb399da7a0fd355

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01-09-2024 13:12

Target

52b0ed0a352304adede2bfc6d269751f1e95580c006e4980ecb399da7a0fd355.exe
Size

2.1MB
MD5

3a99d7f1ed7d75daac18201ffdbb6717
SHA1

6d6c0fd5211a653e4aeec14311b1bebd38903c8c
SHA256

52b0ed0a352304adede2bfc6d269751f1e95580c006e4980ecb399da7a0fd355
SHA512

133b6b27b8f3943fa29baaddc371cff0a8464435722c829210e6a8b2373899515b8dd26404ff5615a3ae02d8de7ff984607acf20310615f695d308f07ab94cd4
SSDEEP

24576:4epWWxAWTvZWJGoBFjuxWkxZIWvG5gQesHDKN3erYdTuxqDx9MLq+koFd3zIisgP:n5+0vY3uxjuw0LAonn9eJ9EWWl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2132	2264	52b0ed0a352304adede2bfc6d269751f1e95580c006e4980ecb399da7a0fd355.exe	30
PID 2264 wrote to memory of 2132	2264	52b0ed0a352304adede2bfc6d269751f1e95580c006e4980ecb399da7a0fd355.exe	30
PID 2264 wrote to memory of 2132	2264	52b0ed0a352304adede2bfc6d269751f1e95580c006e4980ecb399da7a0fd355.exe	30

C:\Users\Admin\AppData\Local\Temp\52b0ed0a352304adede2bfc6d269751f1e95580c006e4980ecb399da7a0fd355.exe
"C:\Users\Admin\AppData\Local\Temp\52b0ed0a352304adede2bfc6d269751f1e95580c006e4980ecb399da7a0fd355.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2264 -s 100
  2⤵
  PID:2132

memory/2264-0-0x000000013F060000-0x000000013F333000-memory.dmp

Filesize
2.8MB

Download