be2b4b6b6d30b9566c801dc35f5ca0cdb6082614d2ec3f101a5100f70d87a254

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 20:28

Target

PO_NO.347819-CONSULTA.exe
Size

710KB
MD5

b58e47e4e59039345c3d5cf2174e57de
SHA1

54f16d3adcde3a9549b7f7deb6170d0f65397215
SHA256

162c5e37fafdeef1e2d1d1d3d49585ab38451f54251833e7a10b4b3476d4f380
SHA512

7e1d2f2f61e1bc12943718cf9cc3d20feb58a2aaeb029f71daad66fb63aa700ab4370919a6bbf14695ea22b42b02a52c88d9d701fdb8da700944f8b535d92b51
SSDEEP

12288:KIR5x+u6RfbWYCrt/22puGGh6abmMbvZwPO5ICnCP1L8idw0sDn2GVOthPc4Ti/+:I3WYatucdv0CP1I4ENOthPZT8Y1OQt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2480	2260	PO_NO.347819-CONSULTA.exe	30
PID 2260 wrote to memory of 2480	2260	PO_NO.347819-CONSULTA.exe	30
PID 2260 wrote to memory of 2480	2260	PO_NO.347819-CONSULTA.exe	30

C:\Users\Admin\AppData\Local\Temp\PO_NO.347819-CONSULTA.exe
"C:\Users\Admin\AppData\Local\Temp\PO_NO.347819-CONSULTA.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2260 -s 28
  2⤵
  PID:2480