53d491fcb95b0cd2c073b1a2b7dc8c032e9de2d9422ac13170fe5975b78f6a7e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/03/2025, 22:02

Target
file.exe
Size 362KB
Sample250315-1xtkjsvtcs
SHA256 53d491fcb95b0cd2c073b1a2b7dc8c032e9de2d9422ac13170fe5975b78f6a7e
MD5 38da35e91c9aeea07d77b7df32e30591
SHA1 49eebb6f1db4065b62e276f61c6f2c6abc0cb66e
SHA512 739d88b2df68063eb0771cfa538bc5fdf9f3485c114c454dfa0dcce554e89cc39e3b970d689bd4c8a80ad595761a39928620cf43c05feb0aea92433870f0b8e0
SSDEEP 6144:YFDI5CzTBC/2tX8QPfembZUrALjlX4goEjkelY2NW2UYclVyqMvhm:YWCzTM2dzPblUrAv5oSs2UZAhm
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1920	2444	file.exe	31
PID 2444 wrote to memory of 1920	2444	file.exe	31
PID 2444 wrote to memory of 1920	2444	file.exe	31

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2444 -s 36
  2⤵
  PID:1920