5fd2ef9baa827c08446ada2ea6ed30ba6b9f4f9c8b8785d6e22dafc32ea323ae

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 11:16

Target

16ef2a6384edbf6bd2594888bf782410.exe
Size

380KB
MD5

16ef2a6384edbf6bd2594888bf782410
SHA1

3ebfd2711ba66e4040796db181684463377ada45
SHA256

5fd2ef9baa827c08446ada2ea6ed30ba6b9f4f9c8b8785d6e22dafc32ea323ae
SHA512

4dcf2b4ea7bded88630fae86b23a7859b53b9e6e7363641bc1b8f9738badd11aa8449407915e5102a5f649c90982945a07f69aa0b503155576724c65382eb556
SSDEEP

6144:ULOUjxnrPr0zfUS6A9utCTCWqWvNk9weEEYwa1zPcTN6zCxHKyvdfU4tT:UpkIA9UrKNk9n4wamTNWWqkdb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2832	2416	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2832	2416	16ef2a6384edbf6bd2594888bf782410.exe	28
PID 2416 wrote to memory of 2832	2416	16ef2a6384edbf6bd2594888bf782410.exe	28
PID 2416 wrote to memory of 2832	2416	16ef2a6384edbf6bd2594888bf782410.exe	28
PID 2416 wrote to memory of 2832	2416	16ef2a6384edbf6bd2594888bf782410.exe	28

C:\Users\Admin\AppData\Local\Temp\16ef2a6384edbf6bd2594888bf782410.exe
"C:\Users\Admin\AppData\Local\Temp\16ef2a6384edbf6bd2594888bf782410.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 204
  2⤵
  - Program crash
  PID:2832

memory/2416-0-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2416-1-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download