9006378885c4a84699ad0f90dbe7579969e3a1b41f6fd334c4e440d30a15d063

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
11-10-2024 01:54

Target

9006378885c4a84699ad0f90dbe7579969e3a1b41f6fd334c4e440d30a15d063.exe
Size

2.6MB
MD5

98e56fc6276f5ea11ed37de5b40116d3
SHA1

882fd2c385eeaffec3881b3262de638ff912f276
SHA256

9006378885c4a84699ad0f90dbe7579969e3a1b41f6fd334c4e440d30a15d063
SHA512

978c3f3e5e866db2cc59a3474a6b75291b3eba44d445887c2afd50218dce776a650822eb67118481e62411b02102c7e49a1dc99db507d4cca59d0253b5b1a19b
SSDEEP

49152:HZPf0tL9d77T+WScpPNBqB0+iZjS9fQzm4qU0Hy+GtGHkyMaRV/EfZ8yd:EVScpPN3OHmUQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 2748	1056	9006378885c4a84699ad0f90dbe7579969e3a1b41f6fd334c4e440d30a15d063.exe	31
PID 1056 wrote to memory of 2748	1056	9006378885c4a84699ad0f90dbe7579969e3a1b41f6fd334c4e440d30a15d063.exe	31
PID 1056 wrote to memory of 2748	1056	9006378885c4a84699ad0f90dbe7579969e3a1b41f6fd334c4e440d30a15d063.exe	31

C:\Users\Admin\AppData\Local\Temp\9006378885c4a84699ad0f90dbe7579969e3a1b41f6fd334c4e440d30a15d063.exe
"C:\Users\Admin\AppData\Local\Temp\9006378885c4a84699ad0f90dbe7579969e3a1b41f6fd334c4e440d30a15d063.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1056 -s 28
  2⤵
  PID:2748

memory/1056-0-0x000000013FDC0000-0x0000000140066000-memory.dmp

Filesize
2.6MB

Download