d3ca102b990985518abf51ba8d71af250d10d9a017cfda853bbd71eafec3de0a

Resubmissions

29-06-2024 23:42

max time kernel
840s
max time network
842s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 23:42

Target

Built/osint.exe
Size

61KB
MD5

eccdb3f0140458279adb0147f5596b1c
SHA1

b09938ab69ba6dd182adf28763f90259a5a8a15f
SHA256

9c6293f95054168d7e1925bd32f3430800a54b99d215af3461f054ef7103ff31
SHA512

1d2b2ee0259f0d2ee5345b96baee1d0cff378f5e630d804d8eb6faad68d82e21bd4b4c1c22bf6f4210f9724daadaa224147ae22cdb00163c10873e53ac06398d
SSDEEP

768:zBnP2ijO8/I/Ih5Fz3g6gYvQ8haqzQc0Vup3tjPPEXZnxPotQY16J10oiD4Jx3m8:4LIhjjrgejPPEJxLY1vozx39

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

osint.exe

description	pid	process	target process
PID 2924 wrote to memory of 3020	2924	osint.exe	WerFault.exe
PID 2924 wrote to memory of 3020	2924	osint.exe	WerFault.exe
PID 2924 wrote to memory of 3020	2924	osint.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Built\osint.exe
"C:\Users\Admin\AppData\Local\Temp\Built\osint.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2924

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2924 -s 504
2⤵
PID:3020

memory/2924-0-0x000007FEF5353000-0x000007FEF5354000-memory.dmp

Filesize
4KB

Download
memory/2924-1-0x00000000008E0000-0x00000000008F6000-memory.dmp

Filesize
88KB

Download
memory/2924-2-0x000007FEF5353000-0x000007FEF5354000-memory.dmp

Filesize
4KB

Download