00f4baa2c37a395129296418b7669e814aaef587efeb298d05f8a698a489ece6

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:14

Target

016aa7c693fae2e917b726ab620abd7a.exe
Size

238KB
MD5

016aa7c693fae2e917b726ab620abd7a
SHA1

ac141fd717b7ede163c94c7176971a50e4d6e663
SHA256

00f4baa2c37a395129296418b7669e814aaef587efeb298d05f8a698a489ece6
SHA512

3daff30262a017b51ea47d373b00d902d2dee3663e4efefb40d53e2343fda4c06ecf21135625a8d83eccefcc6eafaf74424f2cf4d8f8eb93379c74a88f4177b0
SSDEEP

3072:fC88KuCHBTTAJ/bxKOzCJhVnCMkoU97Qe5HZB5ksrHFZqTTeTTTfqTTTJTTTTTnX:q83n4bxKVJ3nCMkQe5HZAsHFZlx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
1752	1716	WerFault.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1752	1716	016aa7c693fae2e917b726ab620abd7a.exe	14
PID 1716 wrote to memory of 1752	1716	016aa7c693fae2e917b726ab620abd7a.exe	14
PID 1716 wrote to memory of 1752	1716	016aa7c693fae2e917b726ab620abd7a.exe	14
PID 1716 wrote to memory of 1752	1716	016aa7c693fae2e917b726ab620abd7a.exe	14
PID 1716 wrote to memory of 1752	1716	016aa7c693fae2e917b726ab620abd7a.exe	14
PID 1716 wrote to memory of 1752	1716	016aa7c693fae2e917b726ab620abd7a.exe	14
PID 1716 wrote to memory of 1752	1716	016aa7c693fae2e917b726ab620abd7a.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 264
1⤵
- Program crash
PID:1752

C:\Users\Admin\AppData\Local\Temp\016aa7c693fae2e917b726ab620abd7a.exe
"C:\Users\Admin\AppData\Local\Temp\016aa7c693fae2e917b726ab620abd7a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716

memory/1716-1-0x0000000000140000-0x0000000000181000-memory.dmp

Filesize
260KB

Download
memory/1716-0-0x0000000000D90000-0x0000000000DD1000-memory.dmp

Filesize
260KB

Download