157d376175189de851094afff36dabdd003151235777c45beb4c4ae43a426244

Analysis

max time kernel
119s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 05:03

Target

157d376175189de851094afff36dabdd003151235777c45beb4c4ae43a426244N.exe
Size

311KB
MD5

aac9cb46fdc770154b4f2a71e6af2bd0
SHA1

50dd0a9e31c2f3e27f36dee5d4904a23776ec3d2
SHA256

157d376175189de851094afff36dabdd003151235777c45beb4c4ae43a426244
SHA512

a8295be1ed98d063968fe5c26ab333b35b2c5c8e9528dc88b63faa7e749933f6b2648876be1d15e7fa2d501726a29052b4fcc771a0134597f8d5b53c17ee1587
SSDEEP

6144:WD10T8d6hY1faZLUHow4CFTPk2rrXVmtiHh7oe+A7S:K0T8d6hYV2sTTPjpmrA7S

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2800	2748	157d376175189de851094afff36dabdd003151235777c45beb4c4ae43a426244N.exe	31
PID 2748 wrote to memory of 2800	2748	157d376175189de851094afff36dabdd003151235777c45beb4c4ae43a426244N.exe	31
PID 2748 wrote to memory of 2800	2748	157d376175189de851094afff36dabdd003151235777c45beb4c4ae43a426244N.exe	31

C:\Users\Admin\AppData\Local\Temp\157d376175189de851094afff36dabdd003151235777c45beb4c4ae43a426244N.exe
"C:\Users\Admin\AppData\Local\Temp\157d376175189de851094afff36dabdd003151235777c45beb4c4ae43a426244N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2748 -s 36
  2⤵
  PID:2800