40d6dbec477fe55c246e2a7fde2aa2eb50d88e0e83dc1137675bd54fe7a990b0

Analysis

max time kernel
23s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 23:03

Target

40d6dbec477fe55c246e2a7fde2aa2eb50d88e0e83dc1137675bd54fe7a990b0N.exe
Size

64KB
MD5

461a246e463f16de32a5c1ef7f05e2a0
SHA1

4f998a72271fb4d80bd3739d24d4f8d1db6c4610
SHA256

40d6dbec477fe55c246e2a7fde2aa2eb50d88e0e83dc1137675bd54fe7a990b0
SHA512

b2909e8a9ce81c06f81057bbfb192ac3ed67ebb13b65e068e0a022d4c28240d0448803ad3ee9293c976fb42e6589ae969e210058feab62e328c0e1402287ff0c
SSDEEP

768:OaVz3PUullJG742zoHPbnCseHjdnQRv1jnAMxkES2:lxJG7t8HPbCdHjRMv9HxW2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2760	2648	40d6dbec477fe55c246e2a7fde2aa2eb50d88e0e83dc1137675bd54fe7a990b0N.exe	31
PID 2648 wrote to memory of 2760	2648	40d6dbec477fe55c246e2a7fde2aa2eb50d88e0e83dc1137675bd54fe7a990b0N.exe	31
PID 2648 wrote to memory of 2760	2648	40d6dbec477fe55c246e2a7fde2aa2eb50d88e0e83dc1137675bd54fe7a990b0N.exe	31

C:\Users\Admin\AppData\Local\Temp\40d6dbec477fe55c246e2a7fde2aa2eb50d88e0e83dc1137675bd54fe7a990b0N.exe
"C:\Users\Admin\AppData\Local\Temp\40d6dbec477fe55c246e2a7fde2aa2eb50d88e0e83dc1137675bd54fe7a990b0N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2648 -s 520
  2⤵
  PID:2760

memory/2648-0-0x000007FEF50C3000-0x000007FEF50C4000-memory.dmp

Filesize
4KB

Download
memory/2648-1-0x0000000000CA0000-0x0000000000CB4000-memory.dmp

Filesize
80KB

Download