a91d9f566a433a99e842f33931932c66b86f8c5b74b4322484e54acaa06a2cff

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 19:25

Target

a91d9f566a433a99e842f33931932c66b86f8c5b74b4322484e54acaa06a2cff.exe
Size

2.2MB
MD5

c1d9f60cd95a73f8e44ea94e3aa7c0a4
SHA1

13ea3d0220f3a61b210731ed65e99a86d0757f4c
SHA256

a91d9f566a433a99e842f33931932c66b86f8c5b74b4322484e54acaa06a2cff
SHA512

b4dc9eacf095f3eb07e08cc782a99009e0be438f24ca79e53d8da727bfec20fbf8050e22382fb9ad44c02d956fb35447fdc5a90da46d18a71d8fa9ebecdf3f50
SSDEEP

24576:VnV20g3y1Nu/hZ99HKG354VTH62rtJNxlf/8D9+qNgzQJWDqVT86sSvPi9tuyU:uWohZTKi49Bff/1QQDqrsSiru

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2560	1908	a91d9f566a433a99e842f33931932c66b86f8c5b74b4322484e54acaa06a2cff.exe	30
PID 1908 wrote to memory of 2560	1908	a91d9f566a433a99e842f33931932c66b86f8c5b74b4322484e54acaa06a2cff.exe	30
PID 1908 wrote to memory of 2560	1908	a91d9f566a433a99e842f33931932c66b86f8c5b74b4322484e54acaa06a2cff.exe	30

C:\Users\Admin\AppData\Local\Temp\a91d9f566a433a99e842f33931932c66b86f8c5b74b4322484e54acaa06a2cff.exe
"C:\Users\Admin\AppData\Local\Temp\a91d9f566a433a99e842f33931932c66b86f8c5b74b4322484e54acaa06a2cff.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1908 -s 44
  2⤵
  PID:2560

memory/1908-1-0x000000013F941000-0x000000013F942000-memory.dmp

Filesize
4KB

Download