d16b2547beaa8ae18959c11c2dde5f75c96e000609e74d05562e038fa947d0b4

Analysis

max time kernel
38s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 06:40

Target

d16b2547beaa8ae18959c11c2dde5f75c96e000609e74d05562e038fa947d0b4.exe
Size

49KB
MD5

6b81963580c9a66b988ddc7604163c30
SHA1

49da25c147fbe8fa19889b459911ae1b369ef0e9
SHA256

d16b2547beaa8ae18959c11c2dde5f75c96e000609e74d05562e038fa947d0b4
SHA512

c4762f02bce7c1299a35a0e234abf05b753bb82fa63e719c7b31af0e1d7a6e8d0cda317332f59be8064a684fbab45d8331a5e8067b7f08dd853c6c5c57d44543
SSDEEP

768:Z1XphQ3B+alRUKRBBYbB1RipwHvEjtE2:fpsp6gB6bB1Rpy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2036	1940	WerFault.exe	12

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2036	1940	d16b2547beaa8ae18959c11c2dde5f75c96e000609e74d05562e038fa947d0b4.exe	28
PID 1940 wrote to memory of 2036	1940	d16b2547beaa8ae18959c11c2dde5f75c96e000609e74d05562e038fa947d0b4.exe	28
PID 1940 wrote to memory of 2036	1940	d16b2547beaa8ae18959c11c2dde5f75c96e000609e74d05562e038fa947d0b4.exe	28
PID 1940 wrote to memory of 2036	1940	d16b2547beaa8ae18959c11c2dde5f75c96e000609e74d05562e038fa947d0b4.exe	28

C:\Users\Admin\AppData\Local\Temp\d16b2547beaa8ae18959c11c2dde5f75c96e000609e74d05562e038fa947d0b4.exe
"C:\Users\Admin\AppData\Local\Temp\d16b2547beaa8ae18959c11c2dde5f75c96e000609e74d05562e038fa947d0b4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 36
  2⤵
  - Program crash
  PID:2036