bf8e3019d3b6d4cf9bbc3e5782e5a7728b3bf04257ce187b7865987169e1fae8

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 07:02

Target

bf8e3019d3b6d4cf9bbc3e5782e5a7728b3bf04257ce187b7865987169e1fae8.exe
Size

6KB
MD5

1d18ee106862a7cdb2ec30f0595d3f01
SHA1

25963672189fd04a6778131e81daf6fd84a2d40f
SHA256

bf8e3019d3b6d4cf9bbc3e5782e5a7728b3bf04257ce187b7865987169e1fae8
SHA512

5a075c2ae9a57379b64526a37ab9d67f4b3beb336e87c1e22aba91b1146fbb9d6d11428383b39c34cb6e1e25439bc0dcf3017f95911d59b7b35f72a5b5672544
SSDEEP

48:SVbt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9uDO:s0mIGnFc/38+N4ZHJWSY9FI5Wqcx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2764	2708	bf8e3019d3b6d4cf9bbc3e5782e5a7728b3bf04257ce187b7865987169e1fae8.exe	30
PID 2708 wrote to memory of 2764	2708	bf8e3019d3b6d4cf9bbc3e5782e5a7728b3bf04257ce187b7865987169e1fae8.exe	30
PID 2708 wrote to memory of 2764	2708	bf8e3019d3b6d4cf9bbc3e5782e5a7728b3bf04257ce187b7865987169e1fae8.exe	30

C:\Users\Admin\AppData\Local\Temp\bf8e3019d3b6d4cf9bbc3e5782e5a7728b3bf04257ce187b7865987169e1fae8.exe
"C:\Users\Admin\AppData\Local\Temp\bf8e3019d3b6d4cf9bbc3e5782e5a7728b3bf04257ce187b7865987169e1fae8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2708 -s 32
  2⤵
  PID:2764