e9e16828fd585a784150fdea276c5d8edfa4149fd33668e83d5f0540214d102c

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 06:20

Target

e9e16828fd585a784150fdea276c5d8edfa4149fd33668e83d5f0540214d102c.exe
Size

5KB
MD5

c639c6b4734038510de1ed6068b094f0
SHA1

b37108f461bd0245d4dc43a1f86bc89a4669f1c4
SHA256

e9e16828fd585a784150fdea276c5d8edfa4149fd33668e83d5f0540214d102c
SHA512

d2178672795c61a15975fff7a68326af1af275c893262c9f8fb5e0d746fe402920ddf7503bb8b73bf6f8f4826dcf30d41aab33f95fcd6dfa6aaa96d8931adfaa
SSDEEP

48:SplXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7taRuqSxp:qWLkFfNnOKYloIQ2pm2pbYS2xE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3008	1988	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 3008	1988	e9e16828fd585a784150fdea276c5d8edfa4149fd33668e83d5f0540214d102c.exe	28
PID 1988 wrote to memory of 3008	1988	e9e16828fd585a784150fdea276c5d8edfa4149fd33668e83d5f0540214d102c.exe	28
PID 1988 wrote to memory of 3008	1988	e9e16828fd585a784150fdea276c5d8edfa4149fd33668e83d5f0540214d102c.exe	28
PID 1988 wrote to memory of 3008	1988	e9e16828fd585a784150fdea276c5d8edfa4149fd33668e83d5f0540214d102c.exe	28

C:\Users\Admin\AppData\Local\Temp\e9e16828fd585a784150fdea276c5d8edfa4149fd33668e83d5f0540214d102c.exe
"C:\Users\Admin\AppData\Local\Temp\e9e16828fd585a784150fdea276c5d8edfa4149fd33668e83d5f0540214d102c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 48
  2⤵
  - Program crash
  PID:3008