99759c6a59da2f576f7229a501644c6361b19ecf8157570f3ed6d233caa690d2

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 14:36

Target

016a98584dcd7d32cabb8009df6067ad.exe
Size

608KB
MD5

016a98584dcd7d32cabb8009df6067ad
SHA1

2e97ea7235e1a58e3fc2ab1c78aaacee32254815
SHA256

99759c6a59da2f576f7229a501644c6361b19ecf8157570f3ed6d233caa690d2
SHA512

54c2084a473985980c942d3d4bff636549fd2a1d2c6b0779c5a2ba6bc8f4b47b7e50a676786fed670732d1b06d9c17de4ad94d60f4f6587e992a788a7da87222
SSDEEP

12288:tYVENZ/EqFBT9RhkqG7Qy2EB0NxDIBuOFe7/uTF:tYOZTXjhk1Qy2DtIoOFdTF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2172	1252	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 2172	1252	016a98584dcd7d32cabb8009df6067ad.exe	14
PID 1252 wrote to memory of 2172	1252	016a98584dcd7d32cabb8009df6067ad.exe	14
PID 1252 wrote to memory of 2172	1252	016a98584dcd7d32cabb8009df6067ad.exe	14
PID 1252 wrote to memory of 2172	1252	016a98584dcd7d32cabb8009df6067ad.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 220
1⤵
- Program crash
PID:2172

C:\Users\Admin\AppData\Local\Temp\016a98584dcd7d32cabb8009df6067ad.exe
"C:\Users\Admin\AppData\Local\Temp\016a98584dcd7d32cabb8009df6067ad.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1252

memory/1252-0-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/1252-2-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download