5d49080ba2a9c92632309dd098f1691c5998484fb65141cc2ced498bf8545107

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 12:28

Target

0ae5b57d6698b7947d305b7b0e816090N.exe
Size

426KB
MD5

0ae5b57d6698b7947d305b7b0e816090
SHA1

9fc29759586cd4374f456d64bb8f0f1765a65571
SHA256

5d49080ba2a9c92632309dd098f1691c5998484fb65141cc2ced498bf8545107
SHA512

e958f560ad3deb259b236c060641cae5824f65d7d38d86388dae2e7245ca9ee1f0a43e7c30b771a89db246f86b46d98291772bf9a4bcc573f871d68497cc2834
SSDEEP

6144:8Z5f30291xuMHlpw9wrvwewMdBtbIbd5xv6P/6CuCNJ0hOYw:8nk291kMHlpw6r4eL3IbxvoyClwzw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 1640	2588	0ae5b57d6698b7947d305b7b0e816090N.exe	30
PID 2588 wrote to memory of 1640	2588	0ae5b57d6698b7947d305b7b0e816090N.exe	30
PID 2588 wrote to memory of 1640	2588	0ae5b57d6698b7947d305b7b0e816090N.exe	30

C:\Users\Admin\AppData\Local\Temp\0ae5b57d6698b7947d305b7b0e816090N.exe
"C:\Users\Admin\AppData\Local\Temp\0ae5b57d6698b7947d305b7b0e816090N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2588 -s 76
  2⤵
  PID:1640