9c5a5fa983d27dafc21ff8164169ad7772e3c0c49b32d0c5346e1854ed1d2e32

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-10-2024 04:41

Target

9c5a5fa983d27dafc21ff8164169ad7772e3c0c49b32d0c5346e1854ed1d2e32N.exe
Size

1.7MB
MD5

b5d3547be863b719e29009f47f7d14a0
SHA1

b7abc61f2c9eb630d38ccea349acca5345939bf7
SHA256

9c5a5fa983d27dafc21ff8164169ad7772e3c0c49b32d0c5346e1854ed1d2e32
SHA512

d3673cb005da62455716ffba477da8c54a3b512a0d7d8edc07ae3b766faef817a2ed8badad036de89386e83c970f88f389a63e8b8d85086095cf860c2d7fa33b
SSDEEP

49152:3bo95a6iGYLWBjosANqicY0a3xdumAFMm6JhQk6pyJ:xWposANqieaXAFMth6p

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2392	2348	9c5a5fa983d27dafc21ff8164169ad7772e3c0c49b32d0c5346e1854ed1d2e32N.exe	30
PID 2348 wrote to memory of 2392	2348	9c5a5fa983d27dafc21ff8164169ad7772e3c0c49b32d0c5346e1854ed1d2e32N.exe	30
PID 2348 wrote to memory of 2392	2348	9c5a5fa983d27dafc21ff8164169ad7772e3c0c49b32d0c5346e1854ed1d2e32N.exe	30

C:\Users\Admin\AppData\Local\Temp\9c5a5fa983d27dafc21ff8164169ad7772e3c0c49b32d0c5346e1854ed1d2e32N.exe
"C:\Users\Admin\AppData\Local\Temp\9c5a5fa983d27dafc21ff8164169ad7772e3c0c49b32d0c5346e1854ed1d2e32N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2348 -s 28
  2⤵
  PID:2392

memory/2348-0-0x000000013FFB0000-0x0000000140165000-memory.dmp

Filesize
1.7MB

Download