85c01193ea42a9fcf96cfb3c2507b45ba35c0c75b76b3fc36a1187422757d394

Analysis

max time kernel
3s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 08:19

Target

85c01193ea42a9fcf96cfb3c2507b45ba35c0c75b76b3fc36a1187422757d394.exe
Size

1.3MB
MD5

fcb1c3415cacd2a15bd13ec371855ec7
SHA1

4907b7a91beb42841a9fea71e74425a0957a1a2c
SHA256

85c01193ea42a9fcf96cfb3c2507b45ba35c0c75b76b3fc36a1187422757d394
SHA512

147b261de581ef985a354af05ee6eb46a02881612f554c8eac8d432079aeaf6d7ae4ce57922c18f6863b85398b0fd326b422646b24521a926aa1d3c718ce036c
SSDEEP

24576:30tT96T4NQJueKknc/SK7pDdNrOxE5env+mYXF2DnH4kCm1W:EWkAu+TudNrkx38F2r4kHW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
960	564	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 960	564	85c01193ea42a9fcf96cfb3c2507b45ba35c0c75b76b3fc36a1187422757d394.exe	28
PID 564 wrote to memory of 960	564	85c01193ea42a9fcf96cfb3c2507b45ba35c0c75b76b3fc36a1187422757d394.exe	28
PID 564 wrote to memory of 960	564	85c01193ea42a9fcf96cfb3c2507b45ba35c0c75b76b3fc36a1187422757d394.exe	28
PID 564 wrote to memory of 960	564	85c01193ea42a9fcf96cfb3c2507b45ba35c0c75b76b3fc36a1187422757d394.exe	28

C:\Users\Admin\AppData\Local\Temp\85c01193ea42a9fcf96cfb3c2507b45ba35c0c75b76b3fc36a1187422757d394.exe
"C:\Users\Admin\AppData\Local\Temp\85c01193ea42a9fcf96cfb3c2507b45ba35c0c75b76b3fc36a1187422757d394.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 92
  2⤵
  - Program crash
  PID:960