83fd2015a5499a8c2703d91aa047d0f099b85e8aa5ef9f2643a4eda4144a8772

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/03/2025, 07:56

Target

0033f75804f1bdff0d0bd5153a6114c3757da40fa823dd18a5742373a905a3e5.exe
Size

897KB
MD5

c04e4f1333266020596775751ba8e035
SHA1

85b265f799ef3d195df6021c280e63376f4b6a90
SHA256

0033f75804f1bdff0d0bd5153a6114c3757da40fa823dd18a5742373a905a3e5
SHA512

47257b2d4483dd1f5c993d49ab19e8a022fb5e08229519d37ce04c2d8a0cb6c2842e866a459d286dcdd4755e2c7a532c3c6ec9bc87a50602c12c57e76e855a98
SSDEEP

12288:5fsW4YtltC18U/Fk6K+ORnO6r+PKlWPT9KoLQmx9YnFcPRmcZjwkNBJN3LwY:5fsWHtltYk9+ORnO6rkTYofx9sSjhp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2292	1688	0033f75804f1bdff0d0bd5153a6114c3757da40fa823dd18a5742373a905a3e5.exe	28
PID 1688 wrote to memory of 2292	1688	0033f75804f1bdff0d0bd5153a6114c3757da40fa823dd18a5742373a905a3e5.exe	28
PID 1688 wrote to memory of 2292	1688	0033f75804f1bdff0d0bd5153a6114c3757da40fa823dd18a5742373a905a3e5.exe	28

C:\Users\Admin\AppData\Local\Temp\0033f75804f1bdff0d0bd5153a6114c3757da40fa823dd18a5742373a905a3e5.exe
"C:\Users\Admin\AppData\Local\Temp\0033f75804f1bdff0d0bd5153a6114c3757da40fa823dd18a5742373a905a3e5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1688 -s 540
  2⤵
  PID:2292

memory/1688-0-0x000007FEF5493000-0x000007FEF5494000-memory.dmp

Filesize
4KB

Download
memory/1688-1-0x0000000000100000-0x00000000001E8000-memory.dmp

Filesize
928KB

Download
memory/1688-2-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/1688-3-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmp

Filesize
9.9MB

Download
memory/1688-4-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmp

Filesize
9.9MB

Download