085c3c1cf21baa3e22e0ac58a5427c290923cd2c1e61895f2886a8e002a56d40

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 04:51

Target

085c3c1cf21baa3e22e0ac58a5427c290923cd2c1e61895f2886a8e002a56d40N.exe
Size

27KB
MD5

b5873b8b59cecf7f7637775006d35650
SHA1

2bbc0088a93380406317bb0b7be2dc8a57cb6f6e
SHA256

085c3c1cf21baa3e22e0ac58a5427c290923cd2c1e61895f2886a8e002a56d40
SHA512

09e20d780a7281187c6caf8fc01592747c41c6eb362d481e716b77d41cb258b05a6e8a6f716ba90a55d5e9d0ef5d54a4558277e02c6bcbfde1e0827bcf74e655
SSDEEP

384:dDq87IDtzWKLKfVOzAfF/ufVGog5KU5YE4Ow90zV4mB3ffxM+bRd/WjpBcDqJN62:hV7IhzWKLK9OzAfQNadCE4QVvqWLWc2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1480	1656	085c3c1cf21baa3e22e0ac58a5427c290923cd2c1e61895f2886a8e002a56d40N.exe	31
PID 1656 wrote to memory of 1480	1656	085c3c1cf21baa3e22e0ac58a5427c290923cd2c1e61895f2886a8e002a56d40N.exe	31
PID 1656 wrote to memory of 1480	1656	085c3c1cf21baa3e22e0ac58a5427c290923cd2c1e61895f2886a8e002a56d40N.exe	31

C:\Users\Admin\AppData\Local\Temp\085c3c1cf21baa3e22e0ac58a5427c290923cd2c1e61895f2886a8e002a56d40N.exe
"C:\Users\Admin\AppData\Local\Temp\085c3c1cf21baa3e22e0ac58a5427c290923cd2c1e61895f2886a8e002a56d40N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1656 -s 492
  2⤵
  PID:1480

memory/1656-0-0x000007FEF63C3000-0x000007FEF63C4000-memory.dmp

Filesize
4KB

Download
memory/1656-1-0x00000000010D0000-0x00000000010DE000-memory.dmp

Filesize
56KB

Download
memory/1656-2-0x000007FEF63C3000-0x000007FEF63C4000-memory.dmp

Filesize
4KB

Download