817338e812ee88e622829ce8d7937b0b97ecef339c96d7048478b07a1774fb90

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-11-2024 07:59

Target

817338e812ee88e622829ce8d7937b0b97ecef339c96d7048478b07a1774fb90N.exe
Size

731KB
MD5

18c66e357b16922dd06ff8cd1d633830
SHA1

45c2985b26a19983e3d74598fa755e8bcae168bf
SHA256

817338e812ee88e622829ce8d7937b0b97ecef339c96d7048478b07a1774fb90
SHA512

f1af1aacd550446457c3af0e253da1cac56d411f25437e5d55694cce689571299716928e8c712099fe8869669a3ee14e1d244c06dc6056f1f4563cbcbd754988
SSDEEP

6144:Fp19SmYRZbsuSBs3ojpe6aABlwZFsr5pOGJr3eRqk3tJc+xZRtiKzvzaOKIeM87G:Fp1EPZbsu2s3ojpe6aeSg3DeRqkUWJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

817338e812ee88e622829ce8d7937b0b97ecef339c96d7048478b07a1774fb90N.exe

description	pid	process	target process
PID 1664 wrote to memory of 1708	1664	817338e812ee88e622829ce8d7937b0b97ecef339c96d7048478b07a1774fb90N.exe	WerFault.exe
PID 1664 wrote to memory of 1708	1664	817338e812ee88e622829ce8d7937b0b97ecef339c96d7048478b07a1774fb90N.exe	WerFault.exe
PID 1664 wrote to memory of 1708	1664	817338e812ee88e622829ce8d7937b0b97ecef339c96d7048478b07a1774fb90N.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\817338e812ee88e622829ce8d7937b0b97ecef339c96d7048478b07a1774fb90N.exe
"C:\Users\Admin\AppData\Local\Temp\817338e812ee88e622829ce8d7937b0b97ecef339c96d7048478b07a1774fb90N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1664 -s 76
  2⤵
  PID:1708