f85432ec4727a9fec4d613592bb3fc8856ddc96acc01f0a8446be4258fc0463e

Analysis

max time kernel
236s
max time network
333s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 16:18

Target

f85432ec4727a9fec4d613592bb3fc8856ddc96acc01f0a8446be4258fc0463e.exe
Size

110KB
MD5

46abef1edfdad57c2644651e722e7225
SHA1

6004050490fbac52b45d337fd7957e9dbe954b84
SHA256

f85432ec4727a9fec4d613592bb3fc8856ddc96acc01f0a8446be4258fc0463e
SHA512

1dd14c459b524c69342ce7b5572357bbc6c350c87f178f9fdf8df440c9d616ba03bb5f6dadf1e263fae6fe49c424b0e950185a95ec953ad6f3180c7a4fca4623
SSDEEP

3072:FvB9m/3ZCfbpNWFhBnpNep/X3c2VlgT0YCW:FbfbDMBnpNep/XM2/gT0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
332	432	WerFault.exe	14

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
432	f85432ec4727a9fec4d613592bb3fc8856ddc96acc01f0a8446be4258fc0463e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 332	432	f85432ec4727a9fec4d613592bb3fc8856ddc96acc01f0a8446be4258fc0463e.exe	28
PID 432 wrote to memory of 332	432	f85432ec4727a9fec4d613592bb3fc8856ddc96acc01f0a8446be4258fc0463e.exe	28
PID 432 wrote to memory of 332	432	f85432ec4727a9fec4d613592bb3fc8856ddc96acc01f0a8446be4258fc0463e.exe	28
PID 432 wrote to memory of 332	432	f85432ec4727a9fec4d613592bb3fc8856ddc96acc01f0a8446be4258fc0463e.exe	28

C:\Users\Admin\AppData\Local\Temp\f85432ec4727a9fec4d613592bb3fc8856ddc96acc01f0a8446be4258fc0463e.exe
"C:\Users\Admin\AppData\Local\Temp\f85432ec4727a9fec4d613592bb3fc8856ddc96acc01f0a8446be4258fc0463e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 184
  2⤵
  - Program crash
  PID:332

memory/432-54-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/432-56-0x0000000001B40000-0x0000000001B95000-memory.dmp

Filesize
340KB

Download