b16e12601037d9179ebce918489f77f9f782fa59d56f2e65fb517f4619129ad8

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 13:32

Target

b16e12601037d9179ebce918489f77f9f782fa59d56f2e65fb517f4619129ad8.exe
Size

172KB
MD5

ac04dfc7ccd9cc317b73f5860da94e7a
SHA1

879a35cc71cd75e3c5ec4b2d8308bc620e2cc0bc
SHA256

b16e12601037d9179ebce918489f77f9f782fa59d56f2e65fb517f4619129ad8
SHA512

6f79e6571ef83706ba7a492545850d7cfbf48fe7cc6d914ee14561c19b81399ffc785c3fea6c430cd1718304dd218cb3d5cfd85610af633ea8eec80bb58c65e0
SSDEEP

3072:2msTTMqqDLy/XUW7TEihWr0u84lUBPGrFQoBZo+lChCjMpTxFM:NqqDLuEW7Tlh+T84lqe1B1DU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2780	3016	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 3544	3016	b16e12601037d9179ebce918489f77f9f782fa59d56f2e65fb517f4619129ad8.exe	97
PID 3016 wrote to memory of 3544	3016	b16e12601037d9179ebce918489f77f9f782fa59d56f2e65fb517f4619129ad8.exe	97
PID 3016 wrote to memory of 3544	3016	b16e12601037d9179ebce918489f77f9f782fa59d56f2e65fb517f4619129ad8.exe	97

C:\Users\Admin\AppData\Local\Temp\b16e12601037d9179ebce918489f77f9f782fa59d56f2e65fb517f4619129ad8.exe
"C:\Users\Admin\AppData\Local\Temp\b16e12601037d9179ebce918489f77f9f782fa59d56f2e65fb517f4619129ad8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Local\Temp\b16e12601037d9179ebce918489f77f9f782fa59d56f2e65fb517f4619129ad8.exe
  "C:\Users\Admin\AppData\Local\Temp\b16e12601037d9179ebce918489f77f9f782fa59d56f2e65fb517f4619129ad8.exe"
  2⤵
  PID:3544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 420
  2⤵
  - Program crash
  PID:2780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3016 -ip 3016
1⤵
PID:1972

memory/3016-0-0x0000000000610000-0x000000000068B000-memory.dmp

Filesize
492KB

Download
memory/3016-1-0x0000000000730000-0x00000000008D3000-memory.dmp

Filesize
1.6MB

Download
memory/3016-2-0x0000000000610000-0x000000000068B000-memory.dmp

Filesize
492KB

Download