624e6402a348d0e691054813994cacc65aededc585cf4791871ca549b723ac3e

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 04:59

Target

624e6402a348d0e691054813994cacc65aededc585cf4791871ca549b723ac3e.exe
Size

68KB
MD5

e25e528053f455cfb913f98e63d03edd
SHA1

a0f4de298a7d3cca8e4b54a55562433eedfcab21
SHA256

624e6402a348d0e691054813994cacc65aededc585cf4791871ca549b723ac3e
SHA512

6206759ba72989a177fe2b88f9bb66fec5521acc0a83956d711eb4f2caa81d9fe7cbf45ff917cf9fc0f85584541478f02a328f53b4a83e03c8d02ea4cd615bed
SSDEEP

1536:wLy50JRJl8Bpa5Np6L6pWfZRgy01YWlMsdBW:wL2olQwn6L6MrwYtsG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2364	2508	624e6402a348d0e691054813994cacc65aededc585cf4791871ca549b723ac3e.exe	30
PID 2508 wrote to memory of 2364	2508	624e6402a348d0e691054813994cacc65aededc585cf4791871ca549b723ac3e.exe	30
PID 2508 wrote to memory of 2364	2508	624e6402a348d0e691054813994cacc65aededc585cf4791871ca549b723ac3e.exe	30

C:\Users\Admin\AppData\Local\Temp\624e6402a348d0e691054813994cacc65aededc585cf4791871ca549b723ac3e.exe
"C:\Users\Admin\AppData\Local\Temp\624e6402a348d0e691054813994cacc65aededc585cf4791871ca549b723ac3e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2508 -s 56
  2⤵
  PID:2364

memory/2508-0-0x000000013F460000-0x000000013F47A000-memory.dmp

Filesize
104KB

Download