e4e9f92d93cc6dc3253f138f8ea60e976a8164d6f3ead409fcc051ca85fecf74

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 22:41

Target

16845c10ca3e677724ed4c6a92616a2c.exe
Size

422KB
MD5

16845c10ca3e677724ed4c6a92616a2c
SHA1

2d231314439c7f407b7ba46db31ccbfa9ab32e10
SHA256

e4e9f92d93cc6dc3253f138f8ea60e976a8164d6f3ead409fcc051ca85fecf74
SHA512

7744e38625671949e3f63b75fb204a46cb97fbfe148f366b89adb0b9857a7b827256860f14681cdc39df21904a7f7c91125989493ab5e6d7f2c96c7e437e8bc0
SSDEEP

6144:ykB1INZdWaFzaE7mDGg7Y4+MFyBPys80G5sEOi9Ri9na5UVx3:ykBgdW/E7mDGg8xMkBp80GiZa5UVh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
880	2892	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 880	2892	16845c10ca3e677724ed4c6a92616a2c.exe	28
PID 2892 wrote to memory of 880	2892	16845c10ca3e677724ed4c6a92616a2c.exe	28
PID 2892 wrote to memory of 880	2892	16845c10ca3e677724ed4c6a92616a2c.exe	28
PID 2892 wrote to memory of 880	2892	16845c10ca3e677724ed4c6a92616a2c.exe	28

C:\Users\Admin\AppData\Local\Temp\16845c10ca3e677724ed4c6a92616a2c.exe
"C:\Users\Admin\AppData\Local\Temp\16845c10ca3e677724ed4c6a92616a2c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 116
  2⤵
  - Program crash
  PID:880

memory/2892-0-0x0000000000370000-0x00000000003DE000-memory.dmp

Filesize
440KB

Download