73b6df0add9bc6b5792d274d316ecd70d636847db25ce6f3e63e77fb72369037

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-11-2024 06:23

Target

48db28a1f4bd01050aa13f021c3b1dfd7aa7ed807592e0a23f3c7afbb7db78c5.exe
Size

674KB
MD5

ab860c777ce9ad76b1c478623e3cda2a
SHA1

38dfc133a769a459ee322488a96179d71da56892
SHA256

48db28a1f4bd01050aa13f021c3b1dfd7aa7ed807592e0a23f3c7afbb7db78c5
SHA512

f23b09e3da1c1f7941a87b57e91ea0988524ad2a2b2aa56114331590e1da0d1d3da98a10626b48ecd995d54d02652236cf03f0707b4132b4c56e8b8d50d25548
SSDEEP

6144:GvZCqtNVfi0ZzEGFwMHViJ1bK+zjD+FM0kz6kUJYeASlF/+xZRtiKzvzaOchY5:GvZCCukzEGCMHViPbK+zWFPkzNzDKO5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 3068	2088	48db28a1f4bd01050aa13f021c3b1dfd7aa7ed807592e0a23f3c7afbb7db78c5.exe	30
PID 2088 wrote to memory of 3068	2088	48db28a1f4bd01050aa13f021c3b1dfd7aa7ed807592e0a23f3c7afbb7db78c5.exe	30
PID 2088 wrote to memory of 3068	2088	48db28a1f4bd01050aa13f021c3b1dfd7aa7ed807592e0a23f3c7afbb7db78c5.exe	30

C:\Users\Admin\AppData\Local\Temp\48db28a1f4bd01050aa13f021c3b1dfd7aa7ed807592e0a23f3c7afbb7db78c5.exe
"C:\Users\Admin\AppData\Local\Temp\48db28a1f4bd01050aa13f021c3b1dfd7aa7ed807592e0a23f3c7afbb7db78c5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2088 -s 76
  2⤵
  PID:3068