615dd41707af9736ba4eeb08a0797395a0edc6fd605718a965c5029cbafe5818

Analysis

max time kernel
71s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/03/2025, 01:05

Target

Setup.exe
Size

759KB
MD5

241e1f1358add031fb9fd18c2a0082b3
SHA1

9f7b9614ed2a3622249df6e7c702168b8b6aa02c
SHA256

129e0c2fa47bb97251800a4cf13f235f38fbe71aa6c98131e7cd85b433dc3204
SHA512

fa06623308b65e6aaa4d137cda9e9126170c378f1f4709b3430eb839c8a408b2bb367b52eb3800f542d04444796f53f5f06711907a440daceaa7d0fa157aaa5c
SSDEEP

12288:vJwFlRKCVTrpBdHY2ebSlZO19bjYN47/oUxFuVIZNZ3qLvxX363910TbwIjq9N:vURrRYJbSlj4oUxIGZNZ3avZKtqXe

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2552	3048	Setup.exe	31
PID 3048 wrote to memory of 2552	3048	Setup.exe	31
PID 3048 wrote to memory of 2552	3048	Setup.exe	31

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3048 -s 36
  2⤵
  PID:2552