2a76dc6d143fd08f25af1a7ded6a639ef2c835b278a3f0b58fe623400a6c5bfc

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 15:27

Target

F2150F127400FDA40D24324B1402D180.exe
Size

83KB
MD5

f2150f127400fda40d24324b1402d180
SHA1

4235a2772fa4fcf3cd40edc70afaa11166c91ccf
SHA256

2a76dc6d143fd08f25af1a7ded6a639ef2c835b278a3f0b58fe623400a6c5bfc
SHA512

5a36245c930c038fcd47767ee92f200aeab821faa003a3fc2cc33045482663bf51048868d6aacbe8c634dc9bd5097d658beb1b5e2f7f334a2ef7e6757aa75c8a
SSDEEP

1536:JaUqTIUyd7B38vkIJUj34xzqt+bpBjqC5ZfaUou:4Uq8U87B38vkIJUUxzqkbppqYaUou

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 2204	820	F2150F127400FDA40D24324B1402D180.exe	30
PID 820 wrote to memory of 2204	820	F2150F127400FDA40D24324B1402D180.exe	30
PID 820 wrote to memory of 2204	820	F2150F127400FDA40D24324B1402D180.exe	30

C:\Users\Admin\AppData\Local\Temp\F2150F127400FDA40D24324B1402D180.exe
"C:\Users\Admin\AppData\Local\Temp\F2150F127400FDA40D24324B1402D180.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:820
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 820 -s 504
  2⤵
  PID:2204

memory/820-0-0x000007FEF4C13000-0x000007FEF4C14000-memory.dmp

Filesize
4KB

Download
memory/820-1-0x00000000008F0000-0x000000000090C000-memory.dmp

Filesize
112KB

Download