89619f55f53bab2ac601976b334d1cd45a5215e325ee24b8c9ca56d0368a5592

Analysis

max time kernel
70s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-11-2024 10:47

Target

89619f55f53bab2ac601976b334d1cd45a5215e325ee24b8c9ca56d0368a5592N.exe
Size

697KB
MD5

84e37c1f7c5669058cc086a8180cdf10
SHA1

f345f7b0f4d3c0e5eb9f2b75f02165b2b21b9f2f
SHA256

89619f55f53bab2ac601976b334d1cd45a5215e325ee24b8c9ca56d0368a5592
SHA512

0c5446b12de4226ad86fc97c1f06f209dffdbeb1971ef483550ae560156c52bf41905de7d497a2005701a41e508f08d640394fe5cb78ef09523b262dfde94983
SSDEEP

6144:lbHgFf0cUDe7WkrqYMMH8xWioVHQv4nldFiN+ihcy5/gt+xZRtiKzvzaOV3Ya+:lbHCfn6krqJMH8xWiEHQvoniNp5nIa+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

89619f55f53bab2ac601976b334d1cd45a5215e325ee24b8c9ca56d0368a5592N.exe

description	pid	process	target process
PID 2764 wrote to memory of 2412	2764	89619f55f53bab2ac601976b334d1cd45a5215e325ee24b8c9ca56d0368a5592N.exe	WerFault.exe
PID 2764 wrote to memory of 2412	2764	89619f55f53bab2ac601976b334d1cd45a5215e325ee24b8c9ca56d0368a5592N.exe	WerFault.exe
PID 2764 wrote to memory of 2412	2764	89619f55f53bab2ac601976b334d1cd45a5215e325ee24b8c9ca56d0368a5592N.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\89619f55f53bab2ac601976b334d1cd45a5215e325ee24b8c9ca56d0368a5592N.exe
"C:\Users\Admin\AppData\Local\Temp\89619f55f53bab2ac601976b334d1cd45a5215e325ee24b8c9ca56d0368a5592N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2764 -s 76
  2⤵
  PID:2412