0856d6f036a28f73814039a090af3327c8781d388fe74539d343674ceb1e8ebc

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 06:15

Target

0856d6f036a28f73814039a090af3327c8781d388fe74539d343674ceb1e8ebc.exe
Size

468KB
MD5

1ae3f8ad70e8f8afc35c91d5d62fd800
SHA1

03a2b61b220162b34d2e84238540e25e6e121b1f
SHA256

0856d6f036a28f73814039a090af3327c8781d388fe74539d343674ceb1e8ebc
SHA512

e4174dd9f3459852e2c715c03ad1f6d326b3a84ef06b871d2e608e8de7fc6005e7e935c5c86a9d12d98797c679fc326cdcb330dc1970e6f51833a5a6f0afee6b
SSDEEP

6144:8qbELf/MR/cWdi5pV/JNWOVhMV99FkojHBIEMOlcOOI8UfsTJyUNom:VdOpNX1hsfpl3OOs9/z

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1272	1284	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 1272	1284	0856d6f036a28f73814039a090af3327c8781d388fe74539d343674ceb1e8ebc.exe	27
PID 1284 wrote to memory of 1272	1284	0856d6f036a28f73814039a090af3327c8781d388fe74539d343674ceb1e8ebc.exe	27
PID 1284 wrote to memory of 1272	1284	0856d6f036a28f73814039a090af3327c8781d388fe74539d343674ceb1e8ebc.exe	27
PID 1284 wrote to memory of 1272	1284	0856d6f036a28f73814039a090af3327c8781d388fe74539d343674ceb1e8ebc.exe	27

C:\Users\Admin\AppData\Local\Temp\0856d6f036a28f73814039a090af3327c8781d388fe74539d343674ceb1e8ebc.exe
"C:\Users\Admin\AppData\Local\Temp\0856d6f036a28f73814039a090af3327c8781d388fe74539d343674ceb1e8ebc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 120
  2⤵
  - Program crash
  PID:1272

memory/1284-54-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download
memory/1284-56-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download