8e5021734b22342186a7b51235fbccc3d72ca27aa940c5b5c5e876d9fd406a85

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
26/03/2025, 15:13

Target
71256c11265d9762446983178290b1d2.exe
Size 974KB
Sample250326-slvdpsyrt5
SHA256 8e5021734b22342186a7b51235fbccc3d72ca27aa940c5b5c5e876d9fd406a85
MD5 71256c11265d9762446983178290b1d2
SHA1 3578f76f0705950d07affe6f0fcdfcd5ec8c66c6
SHA512 aa9e8353c5eab9e18ced0f2aa6770ba39bd622bfa3d9e1581c84d6bbf6f9dd0d02cf1f750b003afe1037b9be2e71c0be5581a6e9c4dc83d9297aed5bad08c98b
SSDEEP 12288:iNjIp/hT9uYSYtk4IhpvyQa/quIi6RaZZBDN0y9GcWNgRcES+3NG8JPm:iEhUTi8SQayuIEN8ukcGEPm
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2528	2344	71256c11265d9762446983178290b1d2.exe	31
PID 2344 wrote to memory of 2528	2344	71256c11265d9762446983178290b1d2.exe	31
PID 2344 wrote to memory of 2528	2344	71256c11265d9762446983178290b1d2.exe	31

C:\Users\Admin\AppData\Local\Temp\71256c11265d9762446983178290b1d2.exe
"C:\Users\Admin\AppData\Local\Temp\71256c11265d9762446983178290b1d2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2344 -s 36
  2⤵
  PID:2528