20c457de6d9f0a30b27be117e08b0638d3cc2908c5a6610d0679fadfa0b98f74

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/11/2024, 00:57

Target

20c457de6d9f0a30b27be117e08b0638d3cc2908c5a6610d0679fadfa0b98f74N.exe
Size

426KB
MD5

b2e3372f02c00253e7965b8821729c10
SHA1

f59777359f893ab6f9c715543283295faac960b2
SHA256

20c457de6d9f0a30b27be117e08b0638d3cc2908c5a6610d0679fadfa0b98f74
SHA512

7d67fdc3c8c4369057fa910214c6c9280fa6271e1811af8e17aaed3183fc1cb1677332715b745919543c3f9fe33fdf83de8cb55b3acfc7610bc1cc6e6019f671
SSDEEP

6144:8Z5f30291xuMHlpw9wrvwewMdBtbIbd5xv6P/6CuCNJ0hOYK:8nk291kMHlpw6r4eL3IbxvoyClwzK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 2704	1448	20c457de6d9f0a30b27be117e08b0638d3cc2908c5a6610d0679fadfa0b98f74N.exe	30
PID 1448 wrote to memory of 2704	1448	20c457de6d9f0a30b27be117e08b0638d3cc2908c5a6610d0679fadfa0b98f74N.exe	30
PID 1448 wrote to memory of 2704	1448	20c457de6d9f0a30b27be117e08b0638d3cc2908c5a6610d0679fadfa0b98f74N.exe	30

C:\Users\Admin\AppData\Local\Temp\20c457de6d9f0a30b27be117e08b0638d3cc2908c5a6610d0679fadfa0b98f74N.exe
"C:\Users\Admin\AppData\Local\Temp\20c457de6d9f0a30b27be117e08b0638d3cc2908c5a6610d0679fadfa0b98f74N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1448 -s 76
  2⤵
  PID:2704