9ed8307cd12604820376ee2aed24f9a8f83ef43ed0338bbff4f2ced5dbffa53a

Analysis

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 09:14

Target

d10449f12f6bd9f29e59600486bd48a49c0f7263a990ed82b9b2a635f4706fac.exe
Size

2.6MB
MD5

3870b1e1ca36deec20214c6ae51f8f16
SHA1

feefcdc98dae9d1a720f8626af58f136f6468a0b
SHA256

d10449f12f6bd9f29e59600486bd48a49c0f7263a990ed82b9b2a635f4706fac
SHA512

840087c0a876bf027dba23d1050534bee2ad31e58b9343290b40c470d28cbde7158c785f200cadf6e5d69539183814b20f343e3130f974b8ce88af8d8ec338cc
SSDEEP

49152:7ZPf0tL9d77T+WScpPNBqB0+iajS9fQzw7baQrppXsg7G4zvw6FGyvoS5QJ+jweu:AVScpPN3l7baQ3sg7G4zvwevoS5QYweu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2628	2476	d10449f12f6bd9f29e59600486bd48a49c0f7263a990ed82b9b2a635f4706fac.exe	30
PID 2476 wrote to memory of 2628	2476	d10449f12f6bd9f29e59600486bd48a49c0f7263a990ed82b9b2a635f4706fac.exe	30
PID 2476 wrote to memory of 2628	2476	d10449f12f6bd9f29e59600486bd48a49c0f7263a990ed82b9b2a635f4706fac.exe	30

C:\Users\Admin\AppData\Local\Temp\d10449f12f6bd9f29e59600486bd48a49c0f7263a990ed82b9b2a635f4706fac.exe
"C:\Users\Admin\AppData\Local\Temp\d10449f12f6bd9f29e59600486bd48a49c0f7263a990ed82b9b2a635f4706fac.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2476 -s 28
  2⤵
  PID:2628

memory/2476-0-0x000000013F060000-0x000000013F306000-memory.dmp

Filesize
2.6MB

Download