fa5c5c41aafb225620119cac0edb8d05299a099b08e22e18536befb08038de1f

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 05:46

Target

3896-154-0x0000000000400000-0x00000000008ED000-memory.exe
Size

4.9MB
MD5

fc00c815376fa11d9274746399bcc401
SHA1

54e79632cbdd951db095ebbaea6a6fd432d2adbd
SHA256

fa5c5c41aafb225620119cac0edb8d05299a099b08e22e18536befb08038de1f
SHA512

f36ffed7babfd539b24ecc1daa98d8391a8e7b57cc9cb827eadfaf91483cce7ffe3c28901ceb57988352b35acbe5a68e9e72345d33e7febd23de41bcda974a5b
SSDEEP

49152:bg9uAs33L6ebwirep8KphDWeTdp5N0O5rydUn5aQ5E8BIytGifV7FKc0iwA01PO:dX+eJ0FN9E8PG4V7eO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

3896-154-0x0000000000400000-0x00000000008ED000-memory.exe

description	pid	process	target process
PID 1464 wrote to memory of 2472	1464	3896-154-0x0000000000400000-0x00000000008ED000-memory.exe	WerFault.exe
PID 1464 wrote to memory of 2472	1464	3896-154-0x0000000000400000-0x00000000008ED000-memory.exe	WerFault.exe
PID 1464 wrote to memory of 2472	1464	3896-154-0x0000000000400000-0x00000000008ED000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3896-154-0x0000000000400000-0x00000000008ED000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\3896-154-0x0000000000400000-0x00000000008ED000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1464 -s 20
2⤵
PID:2472