95338210f49517fa8cfab3f6e3272290af2be0ecf104ab7f65c99eb6192f0f60

Analysis

max time kernel
11s
max time network
20s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
08/02/2025, 05:12

Target

95338210f49517fa8cfab3f6e3272290af2be0ecf104ab7f65c99eb6192f0f60N.exe
Size

697KB
MD5

a0b02f24750618bb612b4edc787fd6c0
SHA1

20ae92d14c0d2396c4670be4bd7ab6641386c607
SHA256

95338210f49517fa8cfab3f6e3272290af2be0ecf104ab7f65c99eb6192f0f60
SHA512

e690b4535ec9f636e4faef4bab9c143bb66e1cacbe85e4fd538e5aeeb93c3185a15096bc562851ed5121fdf7024dfc77e23ebe20a38278c1e71a89fd4dfff2f4
SSDEEP

6144:lbHgFf0cUDe7WkrqYMMH8xWioVHQv4nldFiN+ihcy5/gt+xZRtiKzvzaOV3Ya6:lbHCfn6krqJMH8xWiEHQvoniNp5nIa6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 2712	816	95338210f49517fa8cfab3f6e3272290af2be0ecf104ab7f65c99eb6192f0f60N.exe	30
PID 816 wrote to memory of 2712	816	95338210f49517fa8cfab3f6e3272290af2be0ecf104ab7f65c99eb6192f0f60N.exe	30
PID 816 wrote to memory of 2712	816	95338210f49517fa8cfab3f6e3272290af2be0ecf104ab7f65c99eb6192f0f60N.exe	30

C:\Users\Admin\AppData\Local\Temp\95338210f49517fa8cfab3f6e3272290af2be0ecf104ab7f65c99eb6192f0f60N.exe
"C:\Users\Admin\AppData\Local\Temp\95338210f49517fa8cfab3f6e3272290af2be0ecf104ab7f65c99eb6192f0f60N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 816 -s 76
  2⤵
  PID:2712