c043be1c69e356ae261357913d855e97daccee02129320d69ff7e085073c2827

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 04:43

Target

85f568820c3b35c9cc0a7a5b9f348730.exe
Size

91KB
MD5

85f568820c3b35c9cc0a7a5b9f348730
SHA1

8643dd918ac7112c9d9426adf2e2edb2c3b1ef5a
SHA256

c043be1c69e356ae261357913d855e97daccee02129320d69ff7e085073c2827
SHA512

d180b20a718e838c2a6fcfa9a1f5f6c036d98111eddf8f832303ea2fac1c6fc12881b3660da9b8fc39e9524aeb3cd246a4e0c24bd47ce2be11478058cf9603e0
SSDEEP

1536:KdLEO4TeqI4D/w/S8yYVDcBuuYSQMxZXB448oIO7V2TXbE59sVg0xdy7sdA:gfsewY/S8y4Qh5L58AKXbnfdywO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1784	1588	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1784	1588	85f568820c3b35c9cc0a7a5b9f348730.exe	28
PID 1588 wrote to memory of 1784	1588	85f568820c3b35c9cc0a7a5b9f348730.exe	28
PID 1588 wrote to memory of 1784	1588	85f568820c3b35c9cc0a7a5b9f348730.exe	28
PID 1588 wrote to memory of 1784	1588	85f568820c3b35c9cc0a7a5b9f348730.exe	28

C:\Users\Admin\AppData\Local\Temp\85f568820c3b35c9cc0a7a5b9f348730.exe
"C:\Users\Admin\AppData\Local\Temp\85f568820c3b35c9cc0a7a5b9f348730.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 92
  2⤵
  - Program crash
  PID:1784