b78cc47b0d7de253d92d012dc35d73b3912c9245dc0cc889801270b760f2d9d5

Analysis

max time kernel
13s
max time network
20s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 16:06

Target

Tweaker.exe
Size

69.0MB
MD5

1856f942bf9f23b0fba0de53a4ec794e
SHA1

40e8ef142424304995ca94da40159875d8150cd7
SHA256

b78cc47b0d7de253d92d012dc35d73b3912c9245dc0cc889801270b760f2d9d5
SHA512

ac99b009df9c488c404018b6ad186f31827cc94a55ac1d86e8b64162867459883d53a074dc0963e83526ee2298c2a0cdcdaba30c8e0069a48fc66ba9014ac399
SSDEEP

1572864:qN1fUe2ffbPT72fgmvx5wSKj8qbYOm5L+J:SfUvf6fgmJCSKRbYtLs

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2276	2924	Tweaker.exe	29
PID 2924 wrote to memory of 2276	2924	Tweaker.exe	29
PID 2924 wrote to memory of 2276	2924	Tweaker.exe	29

C:\Users\Admin\AppData\Local\Temp\Tweaker.exe
"C:\Users\Admin\AppData\Local\Temp\Tweaker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2924 -s 544
  2⤵
  PID:2276

memory/2924-0-0x000007FEF5E63000-0x000007FEF5E64000-memory.dmp

Filesize
4KB

Download
memory/2924-1-0x0000000000CA0000-0x00000000051AA000-memory.dmp

Filesize
69.0MB

Download
memory/2924-2-0x000000001F2F0000-0x000000001F3C8000-memory.dmp

Filesize
864KB

Download
memory/2924-3-0x000007FEF5E60000-0x000007FEF684C000-memory.dmp

Filesize
9.9MB

Download
memory/2924-4-0x000007FEF5E60000-0x000007FEF684C000-memory.dmp

Filesize
9.9MB

Download