86ed9a159078f0205703dbd124490854957d5d1c1409d2accc5e75b0f9f4f7e9

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 03:49

Target

85d94ecaa72f9ad252fd053c309528c7.exe
Size

3.4MB
MD5

85d94ecaa72f9ad252fd053c309528c7
SHA1

45386043e6839b66f99234f1abf3bc9380f50b5b
SHA256

86ed9a159078f0205703dbd124490854957d5d1c1409d2accc5e75b0f9f4f7e9
SHA512

add6e6166e33f6adbbc794137359be15b2e17f924f5366e9e636c2c66a9dd112e33d49fd8d5fe6f87236999d77309bec79d23e12392f9d8020f0186666837f0f
SSDEEP

24576:xKc1fAKsUg472lwvDftGsnvhtC67FuLvvPOWOnsrY6Ci7jvUgXB5JMU9U29K63Tu:xF1fZ9g47Sw7TT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2984	2976	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2984	2976	85d94ecaa72f9ad252fd053c309528c7.exe	28
PID 2976 wrote to memory of 2984	2976	85d94ecaa72f9ad252fd053c309528c7.exe	28
PID 2976 wrote to memory of 2984	2976	85d94ecaa72f9ad252fd053c309528c7.exe	28
PID 2976 wrote to memory of 2984	2976	85d94ecaa72f9ad252fd053c309528c7.exe	28

C:\Users\Admin\AppData\Local\Temp\85d94ecaa72f9ad252fd053c309528c7.exe
"C:\Users\Admin\AppData\Local\Temp\85d94ecaa72f9ad252fd053c309528c7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 88
  2⤵
  - Program crash
  PID:2984

memory/2976-0-0x0000000000400000-0x00000000007F4000-memory.dmp

Filesize
4.0MB

Download
memory/2976-1-0x0000000000400000-0x00000000007F4000-memory.dmp

Filesize
4.0MB

Download