8410f4719741e3dbb5f56b74916375bcd3d80b271a96b98b7dc60f488e742f71

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
13-09-2024 07:33

Target

8e398ee76c070356948496bf21b34220N.exe
Size

220KB
MD5

8e398ee76c070356948496bf21b34220
SHA1

469fd3d5807a4a1d7f4fdd94782a1d1c3ea91605
SHA256

8410f4719741e3dbb5f56b74916375bcd3d80b271a96b98b7dc60f488e742f71
SHA512

101e66ac3629941b919626b5ef151a4a5705ab7546e71f214e1886b6f4c37b5b2595ec6dbd09ac5eff24b7e976c8f3527288dd97ed757ee9e1d1bf4012aa48da
SSDEEP

3072:9bCQSIQOaEQm8/f/VsBNgsHEcQkpnhIi9RC4MveSQm4yVsHu:9Sv7HNuNgsHEdE99RC4MvVQxys

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2736	2632	8e398ee76c070356948496bf21b34220N.exe	31
PID 2632 wrote to memory of 2736	2632	8e398ee76c070356948496bf21b34220N.exe	31
PID 2632 wrote to memory of 2736	2632	8e398ee76c070356948496bf21b34220N.exe	31

C:\Users\Admin\AppData\Local\Temp\8e398ee76c070356948496bf21b34220N.exe
"C:\Users\Admin\AppData\Local\Temp\8e398ee76c070356948496bf21b34220N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2632 -s 516
  2⤵
  PID:2736

memory/2632-0-0x000007FEF4EE3000-0x000007FEF4EE4000-memory.dmp

Filesize
4KB

Download
memory/2632-1-0x000000013FFB0000-0x000000013FFEC000-memory.dmp

Filesize
240KB

Download
memory/2632-2-0x000007FEF4EE3000-0x000007FEF4EE4000-memory.dmp

Filesize
4KB

Download