65d0b2d44b9d4d66c80275e096864ee45522153909bcd0d7ae9800ec94688ccc

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 10:30

Target

65d0b2d44b9d4d66c80275e096864ee45522153909bcd0d7ae9800ec94688ccc.exe
Size

11KB
MD5

e26aa1d4b4ce18f4947e497cbd7ba778
SHA1

0b55c3125d5208db89a50d8bb07d6cf39cb4f808
SHA256

65d0b2d44b9d4d66c80275e096864ee45522153909bcd0d7ae9800ec94688ccc
SHA512

8eae57271aecf95df201202dbad350fa1590f8d25fe8b724e7e7248eab4517c2d62145f1767fdcae1ac7545ec421f585d7d8e6326705b1bea5bb47e5bba57fbf
SSDEEP

192:uHEmsn7NEzImJefDu+/VNNTmH6S3Q5tfMcmmKeMDBJ:kRsn7OxAy+/g3Nd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2100	1732	65d0b2d44b9d4d66c80275e096864ee45522153909bcd0d7ae9800ec94688ccc.exe	30
PID 1732 wrote to memory of 2100	1732	65d0b2d44b9d4d66c80275e096864ee45522153909bcd0d7ae9800ec94688ccc.exe	30
PID 1732 wrote to memory of 2100	1732	65d0b2d44b9d4d66c80275e096864ee45522153909bcd0d7ae9800ec94688ccc.exe	30

C:\Users\Admin\AppData\Local\Temp\65d0b2d44b9d4d66c80275e096864ee45522153909bcd0d7ae9800ec94688ccc.exe
"C:\Users\Admin\AppData\Local\Temp\65d0b2d44b9d4d66c80275e096864ee45522153909bcd0d7ae9800ec94688ccc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1732 -s 28
  2⤵
  PID:2100