2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e

Analysis

max time kernel
34s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 08:18

Target

2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e.exe
Size

41KB
MD5

6756602c5b20bc72b6bd3f5b739168d0
SHA1

3152db00257ea8563d542c0a3be36bb23e57c8cc
SHA256

2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e
SHA512

fd1caca1d0a2812b7103c0b6b6b067f422d5a8864c20ddd4f892e9901351585d19fb821b2e9fbac9080bede9c5bab164c6855544e9fda109c18c3acc147d5d5f
SSDEEP

768:+4bahcsaOx7kR0HW6eqvsNwhK+E6Yb2oD7tedlApAKeLLcuTJGAZUDIWFdzRPqPF:+IS9xdHW6ANwMRCbTZ3JGsmpdtPqoO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1900	1972	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1900	1972	2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e.exe	28
PID 1972 wrote to memory of 1900	1972	2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e.exe	28
PID 1972 wrote to memory of 1900	1972	2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e.exe	28
PID 1972 wrote to memory of 1900	1972	2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e.exe	28

C:\Users\Admin\AppData\Local\Temp\2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e.exe
"C:\Users\Admin\AppData\Local\Temp\2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 224
  2⤵
  - Program crash
  PID:1900