3524fc20a9a4618bb8eb9d3e3aba5063519622d565bd0254edee58886db22a62

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 15:25

Target

3524fc20a9a4618bb8eb9d3e3aba5063519622d565bd0254edee58886db22a62N.exe
Size

988KB
MD5

078398717c217424160a6ed528d10740
SHA1

0a92b3f1c575ec9c28cbda49d578e03276912c8f
SHA256

3524fc20a9a4618bb8eb9d3e3aba5063519622d565bd0254edee58886db22a62
SHA512

7b8e07028b47195c7cb8a56ec8d7b327e781c831aaffede6feb92b9f4978e050db3947ab8bb45c01abebe8b60e781c661677ea0364207c36866e0d4f354bc93a
SSDEEP

24576:VwzOH7m6FzOH7mHzOH7mahzOH7mlzOH7ml/yzOHzm:qMBFMoMDhMoMWaS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2156	2388	3524fc20a9a4618bb8eb9d3e3aba5063519622d565bd0254edee58886db22a62N.exe	30
PID 2388 wrote to memory of 2156	2388	3524fc20a9a4618bb8eb9d3e3aba5063519622d565bd0254edee58886db22a62N.exe	30
PID 2388 wrote to memory of 2156	2388	3524fc20a9a4618bb8eb9d3e3aba5063519622d565bd0254edee58886db22a62N.exe	30

C:\Users\Admin\AppData\Local\Temp\3524fc20a9a4618bb8eb9d3e3aba5063519622d565bd0254edee58886db22a62N.exe
"C:\Users\Admin\AppData\Local\Temp\3524fc20a9a4618bb8eb9d3e3aba5063519622d565bd0254edee58886db22a62N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2388 -s 684
  2⤵
  PID:2156

memory/2388-0-0x000007FEF6033000-0x000007FEF6034000-memory.dmp

Filesize
4KB

Download
memory/2388-1-0x0000000010780000-0x000000001087A000-memory.dmp

Filesize
1000KB

Download
memory/2388-2-0x000007FEF6030000-0x000007FEF6A1C000-memory.dmp

Filesize
9.9MB

Download
memory/2388-3-0x000007FEF6033000-0x000007FEF6034000-memory.dmp

Filesize
4KB

Download