5838bac4b95acb58d85846be53b276d3fc64fb8ecc3022f077a4564e95c1e648

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 10:34

Target

160f2b534f512278b2c7362a9f3b7d4b.exe
Size

422KB
MD5

160f2b534f512278b2c7362a9f3b7d4b
SHA1

f7e0392b335b1b593639f66595cb049971ddd110
SHA256

5838bac4b95acb58d85846be53b276d3fc64fb8ecc3022f077a4564e95c1e648
SHA512

4cbed5a84b5a8fbfbc4428c57548eec8083ccf16a7655142920bb4e6bdbc747cce8e16df47c7a861fb5b2272d6cebb2277a5f84d36807ac7288311c2abaf7e29
SSDEEP

6144:ykB1INZdWaFzaE7mDGg7Y4+MFyBPys80G5sEOi9Ri9na5UVx32:ykBgdW/E7mDGg8xMkBp80GiZa5UVh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2680	2768	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2680	2768	160f2b534f512278b2c7362a9f3b7d4b.exe	28
PID 2768 wrote to memory of 2680	2768	160f2b534f512278b2c7362a9f3b7d4b.exe	28
PID 2768 wrote to memory of 2680	2768	160f2b534f512278b2c7362a9f3b7d4b.exe	28
PID 2768 wrote to memory of 2680	2768	160f2b534f512278b2c7362a9f3b7d4b.exe	28

C:\Users\Admin\AppData\Local\Temp\160f2b534f512278b2c7362a9f3b7d4b.exe
"C:\Users\Admin\AppData\Local\Temp\160f2b534f512278b2c7362a9f3b7d4b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 116
  2⤵
  - Program crash
  PID:2680

memory/2768-0-0x0000000001140000-0x00000000011AE000-memory.dmp

Filesize
440KB

Download