e4bc75dbe9a6cf297574a1c875a90b17fbaf89a52fb0bfd531e4d82b513168d2

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-10-2024 05:33

Target

e4bc75dbe9a6cf297574a1c875a90b17fbaf89a52fb0bfd531e4d82b513168d2N.exe
Size

2.7MB
MD5

fdc32de3bf35e88f19746de3100f0d20
SHA1

5a4d47a99792eb2d1dc4a2fc05ab6dd2b2d351a8
SHA256

e4bc75dbe9a6cf297574a1c875a90b17fbaf89a52fb0bfd531e4d82b513168d2
SHA512

31690243214c47bfc8c1c6e8b02a542f396c0e5ac09eeca00d612f5fbad67500c4dab9928054d4b8a592640c8715f6e0f69d01e2674ffd9b17dcdc3ede49a0c1
SSDEEP

49152:gPw34yFJzSdhPzD0mOd4606hU6HznB5NgTsE3gjxt2u9BUbxd2D4OdfR:r9mOd46L5NjEwFt2uDUbxKH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2992	2108	e4bc75dbe9a6cf297574a1c875a90b17fbaf89a52fb0bfd531e4d82b513168d2N.exe	30
PID 2108 wrote to memory of 2992	2108	e4bc75dbe9a6cf297574a1c875a90b17fbaf89a52fb0bfd531e4d82b513168d2N.exe	30
PID 2108 wrote to memory of 2992	2108	e4bc75dbe9a6cf297574a1c875a90b17fbaf89a52fb0bfd531e4d82b513168d2N.exe	30

C:\Users\Admin\AppData\Local\Temp\e4bc75dbe9a6cf297574a1c875a90b17fbaf89a52fb0bfd531e4d82b513168d2N.exe
"C:\Users\Admin\AppData\Local\Temp\e4bc75dbe9a6cf297574a1c875a90b17fbaf89a52fb0bfd531e4d82b513168d2N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2108 -s 28
  2⤵
  PID:2992

memory/2108-0-0x000000013FE60000-0x0000000140116000-memory.dmp

Filesize
2.7MB

Download