22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9

Analysis

Target

22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe
Size

212KB
MD5

0c4a0a1d43bc8a7c69fa423ea2923a9f
SHA1

fb2b154989c6fb8b6a9d9b10eb59999f5e84ce8d
SHA256

22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9
SHA512

d7060323e4a1e1366a367573a387caba66a7eb3a95b9a305461d27043beb634c101e70dda6d61b47b54e751582cb80f843b4ecaeaeca8382a3d605dca52b418b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1460 1620 WerFault.exe 22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe

pid process

1620 22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe

pid	pid_target	process	target process
1460	1620	WerFault.exe	22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe

pid	process
1620	22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe

description	pid	process	target process
PID 1620 wrote to memory of 1460	1620	22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe	WerFault.exe
PID 1620 wrote to memory of 1460	1620	22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe	WerFault.exe
PID 1620 wrote to memory of 1460	1620	22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe	WerFault.exe
PID 1620 wrote to memory of 1460	1620	22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 360
2⤵
- Program crash
PID:1460

memory/1460-58-0x0000000000000000-mapping.dmp

Download
memory/1620-56-0x0000000002E91000-0x0000000002E96000-memory.dmp

Filesize
20KB

Download
memory/1620-57-0x0000000075951000-0x0000000075953000-memory.dmp

Filesize
8KB

Download
memory/1620-59-0x00000000002A0000-0x00000000002AA000-memory.dmp

Filesize
40KB

Download
memory/1620-60-0x00000000002A0000-0x00000000002AA000-memory.dmp

Filesize
40KB

Download
memory/1620-62-0x00000000002A0000-0x00000000002AA000-memory.dmp

Filesize
40KB

Download
memory/1620-61-0x00000000002A0000-0x00000000002AA000-memory.dmp

Filesize
40KB

Download