fa005691b0c202bbac2b34c5bf2670b38b0910ee54c5a8b4627695dec42aca62

Analysis

max time kernel
119s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-11-2024 15:19

Target

fa005691b0c202bbac2b34c5bf2670b38b0910ee54c5a8b4627695dec42aca62N.exe
Size

731KB
MD5

4dd0b137528c80e3f4c184074ea91630
SHA1

a439a5478e0e31143b7f4b5242170a13b7837e17
SHA256

fa005691b0c202bbac2b34c5bf2670b38b0910ee54c5a8b4627695dec42aca62
SHA512

0144ad113e586a10ec77c381d8376fcc95020948aa24681eab85cae3163ed86ef755271283ac1c44dc85b2d933043b9022d5eedca6ad181e8b0cfad6885b56f2
SSDEEP

6144:Fp19SmYRZbsuSBs3ojpe6aABlwZFsr5pOGJr3eRqk3tJc+xZRtiKzvzaOKIeM87P:Fp1EPZbsu2s3ojpe6aeSg3DeRqkUWo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fa005691b0c202bbac2b34c5bf2670b38b0910ee54c5a8b4627695dec42aca62N.exe

description	pid	process	target process
PID 2692 wrote to memory of 2764	2692	fa005691b0c202bbac2b34c5bf2670b38b0910ee54c5a8b4627695dec42aca62N.exe	WerFault.exe
PID 2692 wrote to memory of 2764	2692	fa005691b0c202bbac2b34c5bf2670b38b0910ee54c5a8b4627695dec42aca62N.exe	WerFault.exe
PID 2692 wrote to memory of 2764	2692	fa005691b0c202bbac2b34c5bf2670b38b0910ee54c5a8b4627695dec42aca62N.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fa005691b0c202bbac2b34c5bf2670b38b0910ee54c5a8b4627695dec42aca62N.exe
"C:\Users\Admin\AppData\Local\Temp\fa005691b0c202bbac2b34c5bf2670b38b0910ee54c5a8b4627695dec42aca62N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2692 -s 76
  2⤵
  PID:2764