42de939d3c42d45667274138a95e666bc815bf32baa9786c8a522a339d3d18f6

Analysis

max time kernel
161s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 10:38

Target

16297e49de16fad1803d233780d5f34a.exe
Size

2.5MB
MD5

16297e49de16fad1803d233780d5f34a
SHA1

681a8b7da260661cebb67c11a2e7e076625901ad
SHA256

42de939d3c42d45667274138a95e666bc815bf32baa9786c8a522a339d3d18f6
SHA512

1dcf79b9e8ee1e78e1288eef9168edadf743790d683016e1e0e3c9900ece4a5f56a40b63ee9a6b24bce667f6454b04ff8d5a8130f098d80989e61e53ca3c934a
SSDEEP

49152:o24qutt2VcLAddy7Kcp3X2QhXDG6ZrTPwbbYLbaVZeoOUsi8Fet9lRP2ZfR7xd3:F4qutdBCj/1Yw80tNP2pnx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2400	2656	WerFault.exe	10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2400	2656	16297e49de16fad1803d233780d5f34a.exe	28
PID 2656 wrote to memory of 2400	2656	16297e49de16fad1803d233780d5f34a.exe	28
PID 2656 wrote to memory of 2400	2656	16297e49de16fad1803d233780d5f34a.exe	28
PID 2656 wrote to memory of 2400	2656	16297e49de16fad1803d233780d5f34a.exe	28

C:\Users\Admin\AppData\Local\Temp\16297e49de16fad1803d233780d5f34a.exe
"C:\Users\Admin\AppData\Local\Temp\16297e49de16fad1803d233780d5f34a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 140
  2⤵
  - Program crash
  PID:2400

memory/2656-0-0x0000000000400000-0x0000000000696000-memory.dmp

Filesize
2.6MB

Download