9b3208207053da61095e46b0a469c94184c1bd47b8829165cf042b16c4d0e558

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-09-2024 07:28

Target

9b3208207053da61095e46b0a469c94184c1bd47b8829165cf042b16c4d0e558N.exe
Size

731KB
MD5

9202211384d0824911919b591ac47260
SHA1

c93c9f892fe8f94bb310fc1d8775c0e8638f8229
SHA256

9b3208207053da61095e46b0a469c94184c1bd47b8829165cf042b16c4d0e558
SHA512

8f59faa7e841367de3f297d3a974da94c2965f01d44f5e56c553ebaa97944bd8a671c96d5b15d98fdac278c301d463353b161f7db9cc27999615c2a01c079a9d
SSDEEP

6144:Fp19SmYRZbsuSBs3ojpe6aABlwZFsr5pOGJr3eRqk3tJc+xZRtiKzvzaOKIeM87H:Fp1EPZbsu2s3ojpe6aeSg3DeRqkUWs

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

9b3208207053da61095e46b0a469c94184c1bd47b8829165cf042b16c4d0e558N.exe

description	pid	process	target process
PID 2536 wrote to memory of 1640	2536	9b3208207053da61095e46b0a469c94184c1bd47b8829165cf042b16c4d0e558N.exe	WerFault.exe
PID 2536 wrote to memory of 1640	2536	9b3208207053da61095e46b0a469c94184c1bd47b8829165cf042b16c4d0e558N.exe	WerFault.exe
PID 2536 wrote to memory of 1640	2536	9b3208207053da61095e46b0a469c94184c1bd47b8829165cf042b16c4d0e558N.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9b3208207053da61095e46b0a469c94184c1bd47b8829165cf042b16c4d0e558N.exe
"C:\Users\Admin\AppData\Local\Temp\9b3208207053da61095e46b0a469c94184c1bd47b8829165cf042b16c4d0e558N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2536 -s 76
  2⤵
  PID:1640