8c31951de46eb1660f10f723287897d61ba9aef679f8d89685c80aac97a6c399

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 11:30

Target

2176-1-0x0000000140000000-0x00000001400042A0-memory.exe
Size

16KB
MD5

86e3dbc8465bbe81c0d481c5a2dfd853
SHA1

c3b2b3748ee3cee602815c0e2ade2f2cf7a6e760
SHA256

8c31951de46eb1660f10f723287897d61ba9aef679f8d89685c80aac97a6c399
SHA512

5e721faf97bce5c7d742eb4d6bdadcabd3faca42466088c6915a5917bf0946d337df6a082d98dfce6b0d7babeccc940ec03bd8f5f280b3c2bdb282e15a338e04
SSDEEP

24:eFGStrJ9u0/6/Kl/XnZdGBQAV5caKtRqgueNDMSCvOppmB9:is0muzGBQLaK+SD9C2OB9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2504	2452	2176-1-0x0000000140000000-0x00000001400042A0-memory.exe	30
PID 2452 wrote to memory of 2504	2452	2176-1-0x0000000140000000-0x00000001400042A0-memory.exe	30
PID 2452 wrote to memory of 2504	2452	2176-1-0x0000000140000000-0x00000001400042A0-memory.exe	30

C:\Users\Admin\AppData\Local\Temp\2176-1-0x0000000140000000-0x00000001400042A0-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2176-1-0x0000000140000000-0x00000001400042A0-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2452 -s 20
  2⤵
  PID:2504

memory/2452-0-0x0000000140000000-0x00000001400042A0-memory.dmp

Filesize
16KB

Download