f9df02d5127f3168db3d372c02ea6e01d8388fb458b9f6508e76a27853be67b4

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
04/01/2025, 09:34

Target

f9df02d5127f3168db3d372c02ea6e01d8388fb458b9f6508e76a27853be67b4.exe
Size

669KB
MD5

2443a6ef0138d2466f3f6526a60fc8d1
SHA1

e362fda114a439d9b8da6c88676c4414807e9694
SHA256

f9df02d5127f3168db3d372c02ea6e01d8388fb458b9f6508e76a27853be67b4
SHA512

e20349e9b6dd11692bbe71629afc7d3bb0b7a2a376bea998f7a1d4b9fb1c016acffe28c41c7636ce689820d52fecb3d9f9c4ec0bd34d4f2760184e3468d87066
SSDEEP

6144:SwrGnfIRzRSPpwMHjH4ZGL3O0b83ii96AMaJB8udk4+xZRtiKzvzaOLVYe:SAGwtRSPuMHjH0GL3OB3x6Faa6e

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 2744	1428	f9df02d5127f3168db3d372c02ea6e01d8388fb458b9f6508e76a27853be67b4.exe	29
PID 1428 wrote to memory of 2744	1428	f9df02d5127f3168db3d372c02ea6e01d8388fb458b9f6508e76a27853be67b4.exe	29
PID 1428 wrote to memory of 2744	1428	f9df02d5127f3168db3d372c02ea6e01d8388fb458b9f6508e76a27853be67b4.exe	29

C:\Users\Admin\AppData\Local\Temp\f9df02d5127f3168db3d372c02ea6e01d8388fb458b9f6508e76a27853be67b4.exe
"C:\Users\Admin\AppData\Local\Temp\f9df02d5127f3168db3d372c02ea6e01d8388fb458b9f6508e76a27853be67b4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1428 -s 76
  2⤵
  PID:2744