bab8b9acf1a759190b26244d5e3f7315b9093270477d6d5f231245ffc38a889a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-10-2024 01:53

Target

bab8b9acf1a759190b26244d5e3f7315b9093270477d6d5f231245ffc38a889a.exe
Size

1.7MB
MD5

6ec2a541fa04ed26f3ab57062c525df7
SHA1

f282b317e1127a365796abd1946b01abddf28912
SHA256

bab8b9acf1a759190b26244d5e3f7315b9093270477d6d5f231245ffc38a889a
SHA512

e44dbf482d4b01b8549b28b8c93ebc53b7f408197a023a2485dd702ed26a65c9667cb96c777c65367dfbff6b0c1eb08cf7e55e7a276281462d60485235eadd73
SSDEEP

24576:wGbopD5a6pYGYamhD5+Pf5tWpd5GMUJx8tY9+2JuSsqSkVQX9rQochzH:dbo95a6iGYr5gfGpd5GMJtYg2HSI4Qo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2164	2416	bab8b9acf1a759190b26244d5e3f7315b9093270477d6d5f231245ffc38a889a.exe	31
PID 2416 wrote to memory of 2164	2416	bab8b9acf1a759190b26244d5e3f7315b9093270477d6d5f231245ffc38a889a.exe	31
PID 2416 wrote to memory of 2164	2416	bab8b9acf1a759190b26244d5e3f7315b9093270477d6d5f231245ffc38a889a.exe	31

C:\Users\Admin\AppData\Local\Temp\bab8b9acf1a759190b26244d5e3f7315b9093270477d6d5f231245ffc38a889a.exe
"C:\Users\Admin\AppData\Local\Temp\bab8b9acf1a759190b26244d5e3f7315b9093270477d6d5f231245ffc38a889a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2416 -s 28
  2⤵
  PID:2164

memory/2416-0-0x000000013FD30000-0x000000013FEE5000-memory.dmp

Filesize
1.7MB

Download