ceba2c86afbcafec83c35c4a501db488ededa75515d55df652aa22ac9bc9dac6

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
23-01-2025 04:15

Target

ceba2c86afbcafec83c35c4a501db488ededa75515d55df652aa22ac9bc9dac6.exe
Size

615KB
MD5

a70322c6cc4b2cf7b2e21e54eaa49643
SHA1

3da33eb5a8bcdbc578b56984d9883c598f3786c1
SHA256

ceba2c86afbcafec83c35c4a501db488ededa75515d55df652aa22ac9bc9dac6
SHA512

accda190a6ab65b2a5929cf17eea28b3812858b0a629a6aa92e5b41c8cd1d1d183763ec7c59abd800ffdedb0b06006a36a30a6f875c08a7279d456090ea60124
SSDEEP

12288:hQUqaxXOuZv5s2PIbZyxyLUL+z14JqY+W6Y6Y4CYYYY4pYYYYdYYYYwYYYYaYYYn:hQUnZa2wbZyxyLG+z1VY+W6Y6Y4CYYYQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1884	848	ceba2c86afbcafec83c35c4a501db488ededa75515d55df652aa22ac9bc9dac6.exe	31
PID 848 wrote to memory of 1884	848	ceba2c86afbcafec83c35c4a501db488ededa75515d55df652aa22ac9bc9dac6.exe	31
PID 848 wrote to memory of 1884	848	ceba2c86afbcafec83c35c4a501db488ededa75515d55df652aa22ac9bc9dac6.exe	31
PID 848 wrote to memory of 1884	848	ceba2c86afbcafec83c35c4a501db488ededa75515d55df652aa22ac9bc9dac6.exe	31
PID 848 wrote to memory of 2776	848	ceba2c86afbcafec83c35c4a501db488ededa75515d55df652aa22ac9bc9dac6.exe	32
PID 848 wrote to memory of 2776	848	ceba2c86afbcafec83c35c4a501db488ededa75515d55df652aa22ac9bc9dac6.exe	32
PID 848 wrote to memory of 2776	848	ceba2c86afbcafec83c35c4a501db488ededa75515d55df652aa22ac9bc9dac6.exe	32

C:\Users\Admin\AppData\Local\Temp\ceba2c86afbcafec83c35c4a501db488ededa75515d55df652aa22ac9bc9dac6.exe
"C:\Users\Admin\AppData\Local\Temp\ceba2c86afbcafec83c35c4a501db488ededa75515d55df652aa22ac9bc9dac6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1884
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 848 -s 16
  2⤵
  PID:2776