42e30cdc913d71726c11ff0c15fd56fe7b862088c8169560edd3d1e3a49c05fd

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-10-2024 13:09

Target

42e30cdc913d71726c11ff0c15fd56fe7b862088c8169560edd3d1e3a49c05fd.exe
Size

1.3MB
MD5

bc1d569c172776b8f83984b2eb96024b
SHA1

1d713d70f9c7650df3f0a861326f5bc703682450
SHA256

42e30cdc913d71726c11ff0c15fd56fe7b862088c8169560edd3d1e3a49c05fd
SHA512

5e22e47be557ee9cd7b1d005e8fa04e0ee0b463a6b00a4d0e53c58f8d46440b4e9cd5275f45ec10f5fe5bc84987b95d2eee0a41d65639c27f604b2afcf8167df
SSDEEP

24576:tK0Ucuk09MvA6XKVRZ/5OPYT5lCGtG6r7Yl:tEcuk09MvaEPYdBG6o

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 1332	2668	42e30cdc913d71726c11ff0c15fd56fe7b862088c8169560edd3d1e3a49c05fd.exe	32
PID 2668 wrote to memory of 1332	2668	42e30cdc913d71726c11ff0c15fd56fe7b862088c8169560edd3d1e3a49c05fd.exe	32
PID 2668 wrote to memory of 1332	2668	42e30cdc913d71726c11ff0c15fd56fe7b862088c8169560edd3d1e3a49c05fd.exe	32

C:\Users\Admin\AppData\Local\Temp\42e30cdc913d71726c11ff0c15fd56fe7b862088c8169560edd3d1e3a49c05fd.exe
"C:\Users\Admin\AppData\Local\Temp\42e30cdc913d71726c11ff0c15fd56fe7b862088c8169560edd3d1e3a49c05fd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2668 -s 488
  2⤵
  PID:1332

memory/2668-0-0x000007FEF58D3000-0x000007FEF58D4000-memory.dmp

Filesize
4KB

Download
memory/2668-1-0x0000000001370000-0x00000000014CA000-memory.dmp

Filesize
1.4MB

Download