eb54d30023e49d0011541e221748e407e4828d5c5362c92093e1c00cbe5d663c

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 10:52

Target

16781a42067643f17a38ea79ae89b92c.exe
Size

358KB
MD5

16781a42067643f17a38ea79ae89b92c
SHA1

e01e40a41694cd380504131499cf74f669f39091
SHA256

eb54d30023e49d0011541e221748e407e4828d5c5362c92093e1c00cbe5d663c
SHA512

cb1b752ff180c8ac561674774ffc46231b455cf9b81b6c60b998a798fef16b682d2d915f43e1c5d1dee59a47503ab5ded98aa05aea8ade978911759efe211be9
SSDEEP

6144:0MO6hNjztcL9MM8slfafsAHH60zE016g++cQZA/w3qC5JtoaJG/S:01ujztcL9MMJlfafRH60Q0mrQZA/Qvtw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2360	2348	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2360	2348	16781a42067643f17a38ea79ae89b92c.exe	14
PID 2348 wrote to memory of 2360	2348	16781a42067643f17a38ea79ae89b92c.exe	14
PID 2348 wrote to memory of 2360	2348	16781a42067643f17a38ea79ae89b92c.exe	14
PID 2348 wrote to memory of 2360	2348	16781a42067643f17a38ea79ae89b92c.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 36
1⤵
- Program crash
PID:2360

C:\Users\Admin\AppData\Local\Temp\16781a42067643f17a38ea79ae89b92c.exe
"C:\Users\Admin\AppData\Local\Temp\16781a42067643f17a38ea79ae89b92c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348

memory/2348-0-0x0000000000400000-0x00000000005FC000-memory.dmp

Filesize
2.0MB

Download