85a625860274395a882546629b59d4f5908d99425a04148acfa2a7df71ce94bf

Analysis

max time kernel
4s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 14:01

Target

85a625860274395a882546629b59d4f5908d99425a04148acfa2a7df71ce94bf.exe
Size

246KB
MD5

329337c58dd77613df75f8146cea65b7
SHA1

f8c766cfbe68315a751a4f5c2eeb313e0e17d2a1
SHA256

85a625860274395a882546629b59d4f5908d99425a04148acfa2a7df71ce94bf
SHA512

0240f604973a0f7e71a5779d944a795aff71b24b9d90df768e8e8a486235111d2e27f09013bdfb5752875b3091a736e91bb3843cc8c55d6b9e3ace73cd26a71b
SSDEEP

6144:mMOkz1+hSaPlVDZPO9TxOyVLBK3q6gyD:mLkp+hSqBZW8yVQPgy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1332	1096	WerFault.exe	7

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1332	1096	85a625860274395a882546629b59d4f5908d99425a04148acfa2a7df71ce94bf.exe	28
PID 1096 wrote to memory of 1332	1096	85a625860274395a882546629b59d4f5908d99425a04148acfa2a7df71ce94bf.exe	28
PID 1096 wrote to memory of 1332	1096	85a625860274395a882546629b59d4f5908d99425a04148acfa2a7df71ce94bf.exe	28
PID 1096 wrote to memory of 1332	1096	85a625860274395a882546629b59d4f5908d99425a04148acfa2a7df71ce94bf.exe	28
PID 1096 wrote to memory of 1332	1096	85a625860274395a882546629b59d4f5908d99425a04148acfa2a7df71ce94bf.exe	28
PID 1096 wrote to memory of 1332	1096	85a625860274395a882546629b59d4f5908d99425a04148acfa2a7df71ce94bf.exe	28
PID 1096 wrote to memory of 1332	1096	85a625860274395a882546629b59d4f5908d99425a04148acfa2a7df71ce94bf.exe	28

C:\Users\Admin\AppData\Local\Temp\85a625860274395a882546629b59d4f5908d99425a04148acfa2a7df71ce94bf.exe
"C:\Users\Admin\AppData\Local\Temp\85a625860274395a882546629b59d4f5908d99425a04148acfa2a7df71ce94bf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 268
  2⤵
  - Program crash
  PID:1332

memory/1096-54-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download
memory/1096-56-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1096-57-0x0000000000330000-0x000000000039A000-memory.dmp

Filesize
424KB

Download
memory/1332-55-0x0000000000000000-mapping.dmp

Download