16a536b0f7df09e7a942c506ed76f35c2eec0f8bfb5681aeb1504b990ffffc71

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 22:45

Target

3f38a6b5ce1c06bc66177c5148c2d9ee.exe
Size

1.8MB
MD5

3f38a6b5ce1c06bc66177c5148c2d9ee
SHA1

5ad2ed9b4679bb22f8fc97a55660e92aa2d610b4
SHA256

16a536b0f7df09e7a942c506ed76f35c2eec0f8bfb5681aeb1504b990ffffc71
SHA512

73f57b7c06acd2c7a26655233c5880c8172b160a4282424e674894c6513478e4bfac08b604b16fa517f84225c987a93f08dba65c6728a57500694bfbb76b1c46
SSDEEP

24576:RxYhRHr3bcNSmL7+ldhtyq9tAehagxm+SF+H+4MOqlUbBN7arJ3O3:RxYhRLLcomO/yutA2xm+x+4glqBNY3S

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2324	2376	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2324	2376	3f38a6b5ce1c06bc66177c5148c2d9ee.exe	17
PID 2376 wrote to memory of 2324	2376	3f38a6b5ce1c06bc66177c5148c2d9ee.exe	17
PID 2376 wrote to memory of 2324	2376	3f38a6b5ce1c06bc66177c5148c2d9ee.exe	17
PID 2376 wrote to memory of 2324	2376	3f38a6b5ce1c06bc66177c5148c2d9ee.exe	17

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 36
1⤵
- Program crash
PID:2324

C:\Users\Admin\AppData\Local\Temp\3f38a6b5ce1c06bc66177c5148c2d9ee.exe
"C:\Users\Admin\AppData\Local\Temp\3f38a6b5ce1c06bc66177c5148c2d9ee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2376

memory/2376-0-0x0000000000400000-0x00000000005D7000-memory.dmp

Filesize
1.8MB

Download