be85ce1664fa4a3a202cd6502c5899517359399a8c51f9710d49d25bb64f82e8

Analysis

max time kernel
1s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:53

Target

be85ce1664fa4a3a202cd6502c5899517359399a8c51f9710d49d25bb64f82e8.exe
Size

462KB
MD5

438222b67d2300dd59c39270e54f0c7d
SHA1

83129b8a74a49375af68a49412436c0700f70b5a
SHA256

be85ce1664fa4a3a202cd6502c5899517359399a8c51f9710d49d25bb64f82e8
SHA512

6e9969a6a6c34b4878bf68a5bd54e02871028710d172ac40d20b457126c16faefdd3cdf91a2da2295d6e6ffbbe871f90ce00d88436997fa3c7f4ea98f1cf9309
SSDEEP

12288:mjEtdDbi3Edphw4OovzSlKctF3Wiq6PvnAvavv5:mIfDuUpw4OUzIr3WiqWveo

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1256 772 WerFault.exe be85ce1664fa4a3a202cd6502c5899517359399a8c51f9710d49d25bb64f82e8.exe

pid	pid_target	process	target process
1256	772	WerFault.exe	be85ce1664fa4a3a202cd6502c5899517359399a8c51f9710d49d25bb64f82e8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

be85ce1664fa4a3a202cd6502c5899517359399a8c51f9710d49d25bb64f82e8.exe

description	pid	process	target process
PID 772 wrote to memory of 1256	772	be85ce1664fa4a3a202cd6502c5899517359399a8c51f9710d49d25bb64f82e8.exe	WerFault.exe
PID 772 wrote to memory of 1256	772	be85ce1664fa4a3a202cd6502c5899517359399a8c51f9710d49d25bb64f82e8.exe	WerFault.exe
PID 772 wrote to memory of 1256	772	be85ce1664fa4a3a202cd6502c5899517359399a8c51f9710d49d25bb64f82e8.exe	WerFault.exe
PID 772 wrote to memory of 1256	772	be85ce1664fa4a3a202cd6502c5899517359399a8c51f9710d49d25bb64f82e8.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\be85ce1664fa4a3a202cd6502c5899517359399a8c51f9710d49d25bb64f82e8.exe
"C:\Users\Admin\AppData\Local\Temp\be85ce1664fa4a3a202cd6502c5899517359399a8c51f9710d49d25bb64f82e8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 144
2⤵
- Program crash
PID:1256