f0b96ae3b2e08ff461eb34f783c1d66f1218d1de6f0a455f556d4ca5619330a4

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 11:03

Target

16b0c1ee4b05b0777ca164e321abd6e3.exe
Size

32KB
MD5

16b0c1ee4b05b0777ca164e321abd6e3
SHA1

6dba92e1278a0533c60f3aafb723632d956d4cee
SHA256

f0b96ae3b2e08ff461eb34f783c1d66f1218d1de6f0a455f556d4ca5619330a4
SHA512

c44de933bba88bad9669654f255861d4be101226fc3b7c56f7fa9e967491cf356cad05a2a5e3321157f94be053671cd5be434b5e096d661fbcb18f0622c65f7c
SSDEEP

384:4JzJrHb20hbEGac0eapO9yGmzqzFC+2Lw8P7v6WySQp/pOv6:0N+0hbEKapPGOzLwozeSQRpF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2368	2288	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2368	2288	16b0c1ee4b05b0777ca164e321abd6e3.exe	28
PID 2288 wrote to memory of 2368	2288	16b0c1ee4b05b0777ca164e321abd6e3.exe	28
PID 2288 wrote to memory of 2368	2288	16b0c1ee4b05b0777ca164e321abd6e3.exe	28
PID 2288 wrote to memory of 2368	2288	16b0c1ee4b05b0777ca164e321abd6e3.exe	28

C:\Users\Admin\AppData\Local\Temp\16b0c1ee4b05b0777ca164e321abd6e3.exe
"C:\Users\Admin\AppData\Local\Temp\16b0c1ee4b05b0777ca164e321abd6e3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 88
  2⤵
  - Program crash
  PID:2368

memory/2288-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download