a82da08a181eafbcc779f5af962eebe04e3b973c40f90a37f42ea8d3de7fc70f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
01/11/2024, 15:29

Target

20c840940536dc89016f7d4c78cce2c839ee2106.exe
Size

731KB
MD5

a0c776661815d65a51c4d4c7da408f4d
SHA1

20c840940536dc89016f7d4c78cce2c839ee2106
SHA256

a82da08a181eafbcc779f5af962eebe04e3b973c40f90a37f42ea8d3de7fc70f
SHA512

e19fe7b6cf9c88d89d7566ccbd6f3033e49fd1a89ef515517d2748f175b672f6bff138d87313edc5f2f75a36bf559e00bfa2debff8aeb597b55b882dc223b887
SSDEEP

6144:Fp19SmYRZbsuSBs3ojpe6aABlwZFsr5pOGJr3eRqk3tJc+xZRtiKzvzaOKIeM87e:Fp1EPZbsu2s3ojpe6aeSg3DeRqkUW5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2516	3032	20c840940536dc89016f7d4c78cce2c839ee2106.exe	30
PID 3032 wrote to memory of 2516	3032	20c840940536dc89016f7d4c78cce2c839ee2106.exe	30
PID 3032 wrote to memory of 2516	3032	20c840940536dc89016f7d4c78cce2c839ee2106.exe	30

C:\Users\Admin\AppData\Local\Temp\20c840940536dc89016f7d4c78cce2c839ee2106.exe
"C:\Users\Admin\AppData\Local\Temp\20c840940536dc89016f7d4c78cce2c839ee2106.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3032 -s 76
  2⤵
  PID:2516