99bf3e029228a469a05da0dd317f02620577a054766424c4ea83e0d0820fe6d3

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 13:34

Target

99bf3e029228a469a05da0dd317f02620577a054766424c4ea83e0d0820fe6d3.exe
Size

644KB
MD5

790fa5ba59b19c53b06cf6c132d7c351
SHA1

328f8c47aa968bd5750fb7f46fbb121f81a8f18f
SHA256

99bf3e029228a469a05da0dd317f02620577a054766424c4ea83e0d0820fe6d3
SHA512

f3939d2629e1177953b35dbcc66c044d66b47de8c949fb811e335f38b242629d037f1f71fcc4b25d72cb68f469679119f82ce6c0527a7b0230941a6c58300a58
SSDEEP

6144:qqyk1xZBq65kzLy9tEoEtKE0rdOr1+BhK629PRkY1:qqy2Zo65kzLy92oIt0graIoe

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2620	3060	99bf3e029228a469a05da0dd317f02620577a054766424c4ea83e0d0820fe6d3.exe	31
PID 3060 wrote to memory of 2620	3060	99bf3e029228a469a05da0dd317f02620577a054766424c4ea83e0d0820fe6d3.exe	31
PID 3060 wrote to memory of 2620	3060	99bf3e029228a469a05da0dd317f02620577a054766424c4ea83e0d0820fe6d3.exe	31
PID 3060 wrote to memory of 824	3060	99bf3e029228a469a05da0dd317f02620577a054766424c4ea83e0d0820fe6d3.exe	32
PID 3060 wrote to memory of 824	3060	99bf3e029228a469a05da0dd317f02620577a054766424c4ea83e0d0820fe6d3.exe	32
PID 3060 wrote to memory of 824	3060	99bf3e029228a469a05da0dd317f02620577a054766424c4ea83e0d0820fe6d3.exe	32

C:\Users\Admin\AppData\Local\Temp\99bf3e029228a469a05da0dd317f02620577a054766424c4ea83e0d0820fe6d3.exe
"C:\Users\Admin\AppData\Local\Temp\99bf3e029228a469a05da0dd317f02620577a054766424c4ea83e0d0820fe6d3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:2620
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3060 -s 128
  2⤵
  PID:824