d8d8e2bd36c25798e8243ccb42440baf3f49559a1e251f2f29e70b3d46f597ed

Resubmissions

23-06-2024 06:12

16-07-2023 19:09

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-06-2024 06:12

Target

072f59f857e5b792013df1c7916d31ad467fa3dab84c623a44e62ce35f13a3a5.exe
Size

39KB
MD5

fdbc4c73cbe3ebac5180923c1e85a0a9
SHA1

f7554b64a19910c49bcb9e37763ab9aa1284689e
SHA256

072f59f857e5b792013df1c7916d31ad467fa3dab84c623a44e62ce35f13a3a5
SHA512

de60eb468682cb8bd63dbb134ad328eaf5bb98e492c889929c5912489701d77f7098c807fa455ca43aa42a3ce0f6dca215f28497a32b4f421e90e7d2a08c0992
SSDEEP

768:n/IVNefxlLUvTNW0yGXFzdFpi1KfWky+hd38nl4EdgSC6:QVsfrL3G9dLiceky+hRrEdgSC6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

072f59f857e5b792013df1c7916d31ad467fa3dab84c623a44e62ce35f13a3a5.exe

description	pid	process	target process
PID 1640 wrote to memory of 2876	1640	072f59f857e5b792013df1c7916d31ad467fa3dab84c623a44e62ce35f13a3a5.exe	WerFault.exe
PID 1640 wrote to memory of 2876	1640	072f59f857e5b792013df1c7916d31ad467fa3dab84c623a44e62ce35f13a3a5.exe	WerFault.exe
PID 1640 wrote to memory of 2876	1640	072f59f857e5b792013df1c7916d31ad467fa3dab84c623a44e62ce35f13a3a5.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\072f59f857e5b792013df1c7916d31ad467fa3dab84c623a44e62ce35f13a3a5.exe
"C:\Users\Admin\AppData\Local\Temp\072f59f857e5b792013df1c7916d31ad467fa3dab84c623a44e62ce35f13a3a5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1640 -s 588
2⤵
PID:2876

memory/1640-0-0x000007FEF5A13000-0x000007FEF5A14000-memory.dmp

Filesize
4KB

Download
memory/1640-1-0x0000000001150000-0x000000000115E000-memory.dmp

Filesize
56KB

Download
memory/1640-2-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download