16c1bad167431b5d8a1c2a643572b9087b0021fbf092abd67c6001e4ea2b8bd4

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
12/12/2023, 01:46

Target

16c1bad167431b5d8a1c2a643572b9087b0021fbf092abd67c6001e4ea2b8bd4.exe
Size

86KB
MD5

7c1254715711f7de91dcd0c8e84f8d9e
SHA1

dd9e9afd7f786c0bd1c8ad216709ddc417c54909
SHA256

16c1bad167431b5d8a1c2a643572b9087b0021fbf092abd67c6001e4ea2b8bd4
SHA512

1b6cc1047bc5a2f848021d32ca6c4dec2738708dc901861480a755b429f50d5388c9b53720dbe28fae147503e92bfcb2409b80677a66215fef2ffae8833b7fa9
SSDEEP

1536:+GPQkxypl/sSk81IuWItGMEMlxyplKr7y1xX7:/AplQgIKtGMEMCplKrun

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 3016	2920	16c1bad167431b5d8a1c2a643572b9087b0021fbf092abd67c6001e4ea2b8bd4.exe	28
PID 2920 wrote to memory of 3016	2920	16c1bad167431b5d8a1c2a643572b9087b0021fbf092abd67c6001e4ea2b8bd4.exe	28
PID 2920 wrote to memory of 3016	2920	16c1bad167431b5d8a1c2a643572b9087b0021fbf092abd67c6001e4ea2b8bd4.exe	28

C:\Users\Admin\AppData\Local\Temp\16c1bad167431b5d8a1c2a643572b9087b0021fbf092abd67c6001e4ea2b8bd4.exe
"C:\Users\Admin\AppData\Local\Temp\16c1bad167431b5d8a1c2a643572b9087b0021fbf092abd67c6001e4ea2b8bd4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2920 -s 516
  2⤵
  PID:3016

memory/2920-0-0x0000000000E60000-0x0000000000E76000-memory.dmp

Filesize
88KB

Download
memory/2920-1-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

Filesize
9.9MB

Download
memory/2920-2-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

Filesize
9.9MB

Download