0fe8469cbae130d45ae34e6c0a5c234928ad3776c4999ef03f065f960729408d

Analysis

Target

0fe8469cbae130d45ae34e6c0a5c234928ad3776c4999ef03f065f960729408d.exe
Size

184KB
MD5

86904bef92845b067a76d08ade4cc08b
SHA1

33ce7286d3a5f2cea3c5197e63fcbbc6effa026a
SHA256

0fe8469cbae130d45ae34e6c0a5c234928ad3776c4999ef03f065f960729408d
SHA512

7db74feff0246d8d5564cccbd23dcc555147881c7733f79c6013f9dcfae4f5f8d2fdde28722794665c73fdf85dd5f5d0a895fb9372dcc6fe0170b51cf1b293e2

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

272 1684 WerFault.exe 0fe8469cbae130d45ae34e6c0a5c234928ad3776c4999ef03f065f960729408d.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

0fe8469cbae130d45ae34e6c0a5c234928ad3776c4999ef03f065f960729408d.exe

pid process

1684 0fe8469cbae130d45ae34e6c0a5c234928ad3776c4999ef03f065f960729408d.exe

pid	pid_target	process	target process
272	1684	WerFault.exe	0fe8469cbae130d45ae34e6c0a5c234928ad3776c4999ef03f065f960729408d.exe

pid	process
1684	0fe8469cbae130d45ae34e6c0a5c234928ad3776c4999ef03f065f960729408d.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0fe8469cbae130d45ae34e6c0a5c234928ad3776c4999ef03f065f960729408d.exe

description	pid	process	target process
PID 1684 wrote to memory of 272	1684	0fe8469cbae130d45ae34e6c0a5c234928ad3776c4999ef03f065f960729408d.exe	WerFault.exe
PID 1684 wrote to memory of 272	1684	0fe8469cbae130d45ae34e6c0a5c234928ad3776c4999ef03f065f960729408d.exe	WerFault.exe
PID 1684 wrote to memory of 272	1684	0fe8469cbae130d45ae34e6c0a5c234928ad3776c4999ef03f065f960729408d.exe	WerFault.exe
PID 1684 wrote to memory of 272	1684	0fe8469cbae130d45ae34e6c0a5c234928ad3776c4999ef03f065f960729408d.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 364
2⤵
- Program crash
PID:272

memory/272-57-0x0000000000000000-mapping.dmp

Download
memory/1684-56-0x00000000752D1000-0x00000000752D3000-memory.dmp

Filesize
8KB

Download
memory/1684-58-0x00000000031E1000-0x00000000031E6000-memory.dmp

Filesize
20KB

Download
memory/1684-59-0x0000000001C00000-0x0000000001C0A000-memory.dmp

Filesize
40KB

Download
memory/1684-60-0x0000000001C00000-0x0000000001C0A000-memory.dmp

Filesize
40KB

Download
memory/1684-61-0x0000000001C00000-0x0000000001C0A000-memory.dmp

Filesize
40KB

Download
memory/1684-62-0x0000000001C00000-0x0000000001C0A000-memory.dmp

Filesize
40KB

Download