85615813a3c1ef653b37087ab4ebbf137e1da6d756fb17baa3785bb327f82fef

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 05:30

Target

85615813a3c1ef653b37087ab4ebbf137e1da6d756fb17baa3785bb327f82fef.exe
Size

356KB
MD5

8c7f4679b39d99a9fcd36049e483bfa4
SHA1

f60cc17d80c1bff706e105b1c88de310a2dd6c80
SHA256

85615813a3c1ef653b37087ab4ebbf137e1da6d756fb17baa3785bb327f82fef
SHA512

e72c45b88bf366793d1f6e6bd6575dbe3f5b770d96ac7e1b1de3cac4d26a142b1551cce360af90a78d65dbdba499c921f85e6a0a8e7fa1c66311b8c564ebc9d6
SSDEEP

6144:I8CAneiGnjEPl40Ife35qqy8BoNVwxS+Iv6rfE4STFNXyX7FNXyXNV8rgP:LneDEd40Ife35qq9BnxSfv6rf+Xy7XyR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
988	1696	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 988	1696	85615813a3c1ef653b37087ab4ebbf137e1da6d756fb17baa3785bb327f82fef.exe	27
PID 1696 wrote to memory of 988	1696	85615813a3c1ef653b37087ab4ebbf137e1da6d756fb17baa3785bb327f82fef.exe	27
PID 1696 wrote to memory of 988	1696	85615813a3c1ef653b37087ab4ebbf137e1da6d756fb17baa3785bb327f82fef.exe	27
PID 1696 wrote to memory of 988	1696	85615813a3c1ef653b37087ab4ebbf137e1da6d756fb17baa3785bb327f82fef.exe	27

C:\Users\Admin\AppData\Local\Temp\85615813a3c1ef653b37087ab4ebbf137e1da6d756fb17baa3785bb327f82fef.exe
"C:\Users\Admin\AppData\Local\Temp\85615813a3c1ef653b37087ab4ebbf137e1da6d756fb17baa3785bb327f82fef.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 184
  2⤵
  - Program crash
  PID:988

memory/1696-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1696-55-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download