3b9eff0f6da8df545f807ee301f6a0a79c7c8ca746bbdc3d62eb037706c2c6aa

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-11-2024 00:50

Target

3b9eff0f6da8df545f807ee301f6a0a79c7c8ca746bbdc3d62eb037706c2c6aaN.exe
Size

731KB
MD5

300d84f7733a660da765b19de0a3d530
SHA1

7775c41708a5ec0eae794458edeff7f6a6cbff99
SHA256

3b9eff0f6da8df545f807ee301f6a0a79c7c8ca746bbdc3d62eb037706c2c6aa
SHA512

6c7e9f5b9af769365d1e2796b81eb88b9e5ff61e12a9f981d98428970f49040237dab72e9a18021e2fc3cf1d00699151d423d97fd845755bdc28ccb7aa7675ab
SSDEEP

6144:Fp19SmYRZbsuSBs3ojpe6aABlwZFsr5pOGJr3eRqk3tJc+xZRtiKzvzaOKIeM87x:Fp1EPZbsu2s3ojpe6aeSg3DeRqkUWa

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

3b9eff0f6da8df545f807ee301f6a0a79c7c8ca746bbdc3d62eb037706c2c6aaN.exe

description	pid	process	target process
PID 3068 wrote to memory of 2244	3068	3b9eff0f6da8df545f807ee301f6a0a79c7c8ca746bbdc3d62eb037706c2c6aaN.exe	WerFault.exe
PID 3068 wrote to memory of 2244	3068	3b9eff0f6da8df545f807ee301f6a0a79c7c8ca746bbdc3d62eb037706c2c6aaN.exe	WerFault.exe
PID 3068 wrote to memory of 2244	3068	3b9eff0f6da8df545f807ee301f6a0a79c7c8ca746bbdc3d62eb037706c2c6aaN.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3b9eff0f6da8df545f807ee301f6a0a79c7c8ca746bbdc3d62eb037706c2c6aaN.exe
"C:\Users\Admin\AppData\Local\Temp\3b9eff0f6da8df545f807ee301f6a0a79c7c8ca746bbdc3d62eb037706c2c6aaN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3068 -s 76
  2⤵
  PID:2244