b1a638cc1c6fab24c26193035daa72cdc459deebf7a11de130cf41a4218e81d0

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 01:44

Target

b1a638cc1c6fab24c26193035daa72cdc459deebf7a11de130cf41a4218e81d0.exe
Size

1.7MB
MD5

f9e546bb5a4898d65b61f8b3d93a1662
SHA1

a4f5d8c4fec7657211c71c31f92d347cad13b1c8
SHA256

b1a638cc1c6fab24c26193035daa72cdc459deebf7a11de130cf41a4218e81d0
SHA512

a98fdb03a485051f33ea092b0805d2c2f3e2d3a3a58697a120459139ab2b6c94c27910467cc863ad78defcbf7d90f2edd81fb2356daa9f76bb448e9cf609e037
SSDEEP

49152:ubo95a6iGYtRzPWn9jbijSv3ZXYUYpyc2y5BkA:eBP0OSvZXwpcy5Bk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 3060	3008	b1a638cc1c6fab24c26193035daa72cdc459deebf7a11de130cf41a4218e81d0.exe	30
PID 3008 wrote to memory of 3060	3008	b1a638cc1c6fab24c26193035daa72cdc459deebf7a11de130cf41a4218e81d0.exe	30
PID 3008 wrote to memory of 3060	3008	b1a638cc1c6fab24c26193035daa72cdc459deebf7a11de130cf41a4218e81d0.exe	30

C:\Users\Admin\AppData\Local\Temp\b1a638cc1c6fab24c26193035daa72cdc459deebf7a11de130cf41a4218e81d0.exe
"C:\Users\Admin\AppData\Local\Temp\b1a638cc1c6fab24c26193035daa72cdc459deebf7a11de130cf41a4218e81d0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3008 -s 28
  2⤵
  PID:3060

memory/3008-0-0x000000013F7C0000-0x000000013F975000-memory.dmp

Filesize
1.7MB

Download