b978bcd9a9b2eb3191ac75d89244def0db1e91c5b826f16e900ed9fc47a7879e

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 15:08

Target

b978bcd9a9b2eb3191ac75d89244def0db1e91c5b826f16e900ed9fc47a7879e.exe
Size

1.3MB
MD5

8bb1cc2897fd60cfaaacbadc0cad4588
SHA1

cf059622321d1d5843fc77f2ee443377ef6aa2e6
SHA256

b978bcd9a9b2eb3191ac75d89244def0db1e91c5b826f16e900ed9fc47a7879e
SHA512

b8e1750ec47cb7ade59b84fa08f49fe3f2cf1e0405fb366a21bc63dc7fc907ae7351070fc5631a3a5843db9676b6843784f604a27824d78136d434070562618f
SSDEEP

12288:vVmUr/W3BE4gc51j/q4wVtA3WitFfglrg7tCXZUAiB7gKUSi3YU:Ya/GgcGZNih/U1oU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2828	2728	b978bcd9a9b2eb3191ac75d89244def0db1e91c5b826f16e900ed9fc47a7879e.exe	31
PID 2728 wrote to memory of 2828	2728	b978bcd9a9b2eb3191ac75d89244def0db1e91c5b826f16e900ed9fc47a7879e.exe	31
PID 2728 wrote to memory of 2828	2728	b978bcd9a9b2eb3191ac75d89244def0db1e91c5b826f16e900ed9fc47a7879e.exe	31

C:\Users\Admin\AppData\Local\Temp\b978bcd9a9b2eb3191ac75d89244def0db1e91c5b826f16e900ed9fc47a7879e.exe
"C:\Users\Admin\AppData\Local\Temp\b978bcd9a9b2eb3191ac75d89244def0db1e91c5b826f16e900ed9fc47a7879e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2728 -s 488
  2⤵
  PID:2828

memory/2728-0-0x000007FEF4E83000-0x000007FEF4E84000-memory.dmp

Filesize
4KB

Download
memory/2728-1-0x0000000000E00000-0x0000000000F5E000-memory.dmp

Filesize
1.4MB

Download