2e0ccd8d3ca72b4322294b5b3fbead5d454da524b1fe87bd5687ef00481f7bfe

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 01:10

Target

2e0ccd8d3ca72b4322294b5b3fbead5d454da524b1fe87bd5687ef00481f7bfe.exe
Size

2.4MB
MD5

2552cda61ecc9cffc215808b8310d697
SHA1

bd3c5bfb31cd257606563a44dec61a23b3e2e6e8
SHA256

2e0ccd8d3ca72b4322294b5b3fbead5d454da524b1fe87bd5687ef00481f7bfe
SHA512

dd42dad49c28c3040a1534c88e6ecc5812b9488b2ef59377921ea74db1bb0d258392830f94281a78427b978ed4dc26a1eb2868eabb8b703e9a38533ca84dba31
SSDEEP

49152:pVUJTk3/vizpr2Tv7CJDLeD8O3Rg2JVLe2NKrCAnWwey5:dZ7CJDL4adnzey5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2776	2724	2e0ccd8d3ca72b4322294b5b3fbead5d454da524b1fe87bd5687ef00481f7bfe.exe	30
PID 2724 wrote to memory of 2776	2724	2e0ccd8d3ca72b4322294b5b3fbead5d454da524b1fe87bd5687ef00481f7bfe.exe	30
PID 2724 wrote to memory of 2776	2724	2e0ccd8d3ca72b4322294b5b3fbead5d454da524b1fe87bd5687ef00481f7bfe.exe	30

C:\Users\Admin\AppData\Local\Temp\2e0ccd8d3ca72b4322294b5b3fbead5d454da524b1fe87bd5687ef00481f7bfe.exe
"C:\Users\Admin\AppData\Local\Temp\2e0ccd8d3ca72b4322294b5b3fbead5d454da524b1fe87bd5687ef00481f7bfe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2724 -s 28
  2⤵
  PID:2776

memory/2724-0-0x000000013FF00000-0x0000000140177000-memory.dmp

Filesize
2.5MB

Download