359ac7b1e8531ed6ce9f9a8e8cd8932f7a4fca0fc149008d702e395208c98cec

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 01:01

Target

packages/DirectoryMonitor_[1MB]_[1].exe
Size

1.9MB
MD5

76067380db217854920c9652e6276ae1
SHA1

10442a38db18218953418b84bb8684a3fa399312
SHA256

d74373f86c366409db3392258b552e35477ffd47d968d094abad170663193fc6
SHA512

91a42d2196b42515132ccdbc40dec46396995d80da5a44eded2d16fe4350c50a68a2556a80acdccef823bc233b4fa5a88a6423748e9fea2e23795339795857f9
SSDEEP

12288:hc6VJx4LOQyQLkoCPs+b4H4APA60jEcflSIQZXDVrZLpYHT:hhJxPQySCod3c8pZzhnYHT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

DirectoryMonitor_[1MB]_[1].exe

description	pid	process	target process
PID 1988 wrote to memory of 1592	1988	DirectoryMonitor_[1MB]_[1].exe	WerFault.exe
PID 1988 wrote to memory of 1592	1988	DirectoryMonitor_[1MB]_[1].exe	WerFault.exe
PID 1988 wrote to memory of 1592	1988	DirectoryMonitor_[1MB]_[1].exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\packages\DirectoryMonitor_[1MB]_[1].exe
"C:\Users\Admin\AppData\Local\Temp\packages\DirectoryMonitor_[1MB]_[1].exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1988 -s 532
2⤵
PID:1592

memory/1988-0-0x000007FEF6163000-0x000007FEF6164000-memory.dmp

Filesize
4KB

Download
memory/1988-1-0x00000000000C0000-0x00000000002B0000-memory.dmp

Filesize
1.9MB

Download
memory/1988-2-0x000007FEF6163000-0x000007FEF6164000-memory.dmp

Filesize
4KB

Download