5ecd27eac1d60ef9a4fb6c937ce2687d31e636888421e493e2acd6cfeccaba8c

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 22:46

Target

16c6cb2349cb410cf3a78de8fcc3c688.exe
Size

507KB
MD5

16c6cb2349cb410cf3a78de8fcc3c688
SHA1

0b6ad78f4cecf86165009fcac9575bff873391c3
SHA256

5ecd27eac1d60ef9a4fb6c937ce2687d31e636888421e493e2acd6cfeccaba8c
SHA512

6733948d2eee53f93b23051bd38cf9a6994c103ea1023460fabd0ed56ef22118bef276c1e207bc79d2541ac849e20107f6c44602220bdb63afd0b2fb3124316d
SSDEEP

12288:+9Ogm5KlXU+vF8kM3+HkRTLEPMsmstvxrelk:8vm5WFF8ki+HgTL1smstvxr0k

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
632	2880	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 632	2880	16c6cb2349cb410cf3a78de8fcc3c688.exe	14
PID 2880 wrote to memory of 632	2880	16c6cb2349cb410cf3a78de8fcc3c688.exe	14
PID 2880 wrote to memory of 632	2880	16c6cb2349cb410cf3a78de8fcc3c688.exe	14
PID 2880 wrote to memory of 632	2880	16c6cb2349cb410cf3a78de8fcc3c688.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 124
1⤵
- Program crash
PID:632

C:\Users\Admin\AppData\Local\Temp\16c6cb2349cb410cf3a78de8fcc3c688.exe
"C:\Users\Admin\AppData\Local\Temp\16c6cb2349cb410cf3a78de8fcc3c688.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2880

memory/2880-0-0x0000000001220000-0x000000000127B000-memory.dmp

Filesize
364KB

Download
memory/2880-1-0x0000000001220000-0x000000000127B000-memory.dmp

Filesize
364KB

Download