6115e09aac34c8d02016a6d03206623550b8df429582690598b9c0ef9ce59526

Analysis

max time kernel
37s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 14:31

Target

SpecialHaremClass.exe
Size

219KB
MD5

fa4112df8e96184f2a838b1f91e0f74f
SHA1

612101373a923831527b0c7eab097bf115cc4cfc
SHA256

6115e09aac34c8d02016a6d03206623550b8df429582690598b9c0ef9ce59526
SHA512

b0e1c3ee94a29d24ed1f5d10d4c50439c4903e6e2b9d6392beb43428736ccd2d24c8fa70a39117dfc474f35c3dc3188acd5bf48eb9c3737f20833abd831c55cb
SSDEEP

384:Moq21Zv/Pgw2Tgl+CpAdt+BO7Dq++d0c+1JNomQ+Y+D0+R+a+o+2RKJMX45IX+S3:Mo/gGk5dtEYv1zFN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2068	2196	SpecialHaremClass.exe	30
PID 2196 wrote to memory of 2068	2196	SpecialHaremClass.exe	30
PID 2196 wrote to memory of 2068	2196	SpecialHaremClass.exe	30

C:\Users\Admin\AppData\Local\Temp\SpecialHaremClass.exe
"C:\Users\Admin\AppData\Local\Temp\SpecialHaremClass.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2196 -s 56
  2⤵
  PID:2068

memory/2196-0-0x0000000140000000-0x000000014003E000-memory.dmp

Filesize
248KB

Download