16c5e428c64248d7bf0bbd624b6359b40e36c87267fe5d2bfc26dc09004b26b8

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02/09/2023, 14:28

Target

16c5e428c64248d7bf0bbd624b6359b40e36c87267fe5d2bfc26dc09004b26b8.exe
Size

5KB
MD5

cd510e38c0f7890f9d4353b81a3af0d0
SHA1

ffa95f8e9b60e99e629462bb41506e4bb17920d3
SHA256

16c5e428c64248d7bf0bbd624b6359b40e36c87267fe5d2bfc26dc09004b26b8
SHA512

0fced21e75e2fb4cebaede82d574893d77136aceef7b441d44dcd9f4ef5c507144635a17f497db9590a229e4c1a05b0d06bcb01f1d1e23df5c2ef4d39237e4e6
SSDEEP

48:SVlXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7tSRuqSxp:eWLkFfNnOKYloIQ2pm2pbYSmxE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1996	2176	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1996	2176	16c5e428c64248d7bf0bbd624b6359b40e36c87267fe5d2bfc26dc09004b26b8.exe	28
PID 2176 wrote to memory of 1996	2176	16c5e428c64248d7bf0bbd624b6359b40e36c87267fe5d2bfc26dc09004b26b8.exe	28
PID 2176 wrote to memory of 1996	2176	16c5e428c64248d7bf0bbd624b6359b40e36c87267fe5d2bfc26dc09004b26b8.exe	28
PID 2176 wrote to memory of 1996	2176	16c5e428c64248d7bf0bbd624b6359b40e36c87267fe5d2bfc26dc09004b26b8.exe	28

C:\Users\Admin\AppData\Local\Temp\16c5e428c64248d7bf0bbd624b6359b40e36c87267fe5d2bfc26dc09004b26b8.exe
"C:\Users\Admin\AppData\Local\Temp\16c5e428c64248d7bf0bbd624b6359b40e36c87267fe5d2bfc26dc09004b26b8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 48
  2⤵
  - Program crash
  PID:1996