85c138984bc3de50ffe8e1085417fd0fb95b651904fa806c14e5768b7eee45b4

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 14:07

Target

85c138984bc3de50ffe8e1085417fd0fb95b651904fa806c14e5768b7eee45b4.exe
Size

12KB
MD5

bf0ee7e2ac54dd82b830b54e439ad686
SHA1

69d5fcfc622f3a9e57c8e3d69c5ce4e039b2f0c6
SHA256

85c138984bc3de50ffe8e1085417fd0fb95b651904fa806c14e5768b7eee45b4
SHA512

db31d5ae181791d3bf7e09d6a5d91c40529dda796946f3ba063b40e0a411c3bd7cad0129d8c8d1133d422e6a5fc69f8ef37e84fa6c79b172c4498e224be20fa2
SSDEEP

192:hFNaxeoMGntID65Rz7mXed1CtILfIETAltGPA9mXRy6SEZakpQ:rNwMGY65RmOd1MpmA95EzpQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2560	2760	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2560	2760	85c138984bc3de50ffe8e1085417fd0fb95b651904fa806c14e5768b7eee45b4.exe	29
PID 2760 wrote to memory of 2560	2760	85c138984bc3de50ffe8e1085417fd0fb95b651904fa806c14e5768b7eee45b4.exe	29
PID 2760 wrote to memory of 2560	2760	85c138984bc3de50ffe8e1085417fd0fb95b651904fa806c14e5768b7eee45b4.exe	29
PID 2760 wrote to memory of 2560	2760	85c138984bc3de50ffe8e1085417fd0fb95b651904fa806c14e5768b7eee45b4.exe	29

C:\Users\Admin\AppData\Local\Temp\85c138984bc3de50ffe8e1085417fd0fb95b651904fa806c14e5768b7eee45b4.exe
"C:\Users\Admin\AppData\Local\Temp\85c138984bc3de50ffe8e1085417fd0fb95b651904fa806c14e5768b7eee45b4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 548
  2⤵
  - Program crash
  PID:2560

memory/2760-0-0x0000000074B9E000-0x0000000074B9F000-memory.dmp

Filesize
4KB

Download
memory/2760-1-0x0000000001090000-0x000000000109A000-memory.dmp

Filesize
40KB

Download
memory/2760-2-0x0000000074B9E000-0x0000000074B9F000-memory.dmp

Filesize
4KB

Download