16a6978d7634ec6500f24ef785eecbf622fdeeb1e98ac9247d372a7edea88c49

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:23

Target

37dda36237c6c825ec54fbe89eb17cc7.exe
Size

96KB
MD5

37dda36237c6c825ec54fbe89eb17cc7
SHA1

8c5670974039ac2745f3cf7513be553901cadfbe
SHA256

16a6978d7634ec6500f24ef785eecbf622fdeeb1e98ac9247d372a7edea88c49
SHA512

bc0a151f5959622b0dd5c2bfbfc2714277754a2cab54fd7a503cd6600b043bbaabe36bb04d487965ab59314fd7c4f52d22532bff27b42e389b50428ef5d85292
SSDEEP

1536:3aYJ0K1T6GqqJ1bff0/1rGwVa4l2qtZi5mQh0EjDvzZ0qG58VVirAf8wL:KY65GqqnbfwVVflPmmo0E7p

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2992	2928	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2992	2928	37dda36237c6c825ec54fbe89eb17cc7.exe	28
PID 2928 wrote to memory of 2992	2928	37dda36237c6c825ec54fbe89eb17cc7.exe	28
PID 2928 wrote to memory of 2992	2928	37dda36237c6c825ec54fbe89eb17cc7.exe	28
PID 2928 wrote to memory of 2992	2928	37dda36237c6c825ec54fbe89eb17cc7.exe	28

C:\Users\Admin\AppData\Local\Temp\37dda36237c6c825ec54fbe89eb17cc7.exe
"C:\Users\Admin\AppData\Local\Temp\37dda36237c6c825ec54fbe89eb17cc7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 92
  2⤵
  - Program crash
  PID:2992