547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
25-07-2022 19:07

Target

547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe
Size

164KB
MD5

3ba8dc8d24da92095584ea015e34a30c
SHA1

5c846a3f3b861d566fef2d70afe59ed35c82fecf
SHA256

547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1
SHA512

5f2666e937a9eb6889c081460846544d45824f5c491858af804830d7d6b0baa468cf2262f585e80f3e5d6b7a4c38ec22153af983411b36d333605f197cf471e3

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1808 2012 WerFault.exe 547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe

pid process

2012 547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe

pid	pid_target	process	target process
1808	2012	WerFault.exe	547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe

pid	process
2012	547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe

description	pid	process	target process
PID 2012 wrote to memory of 1808	2012	547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe	WerFault.exe
PID 2012 wrote to memory of 1808	2012	547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe	WerFault.exe
PID 2012 wrote to memory of 1808	2012	547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe	WerFault.exe
PID 2012 wrote to memory of 1808	2012	547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 360
2⤵
- Program crash
PID:1808

memory/1808-57-0x0000000000000000-mapping.dmp

Download
memory/2012-56-0x0000000075791000-0x0000000075793000-memory.dmp

Filesize
8KB

Download
memory/2012-58-0x0000000000471000-0x0000000000476000-memory.dmp

Filesize
20KB

Download
memory/2012-59-0x00000000003F0000-0x00000000003FA000-memory.dmp

Filesize
40KB

Download
memory/2012-60-0x00000000003F0000-0x00000000003FA000-memory.dmp

Filesize
40KB

Download
memory/2012-61-0x00000000003F0000-0x00000000003FA000-memory.dmp

Filesize
40KB

Download