52c666c663f7f89999a3c812b02f248dda0719c0b7d395ed600ed39622796b41

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 01:40

Target

52c666c663f7f89999a3c812b02f248dda0719c0b7d395ed600ed39622796b41.exe
Size

57KB
MD5

9129cdb8c68b6a3f46afa196faf56122
SHA1

b542bd01dbd060819bb11ba3ecdb2b7f3b7aef86
SHA256

52c666c663f7f89999a3c812b02f248dda0719c0b7d395ed600ed39622796b41
SHA512

a532138325f58672da2457fad5a4c2559377e568892dcbcb33e5f51ff71e410c59815ab5398a3019e1bcaea598f01796d813e1713596d06b86b142a097c378e2
SSDEEP

768:5bMPeN2LEt+HANMnBHRGbjyAnJErDV1rixHlVBkK:53WEcHANMnXGbjZnirDV1rixFoK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1452	1932	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1932	52c666c663f7f89999a3c812b02f248dda0719c0b7d395ed600ed39622796b41.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1452	1932	52c666c663f7f89999a3c812b02f248dda0719c0b7d395ed600ed39622796b41.exe	28
PID 1932 wrote to memory of 1452	1932	52c666c663f7f89999a3c812b02f248dda0719c0b7d395ed600ed39622796b41.exe	28
PID 1932 wrote to memory of 1452	1932	52c666c663f7f89999a3c812b02f248dda0719c0b7d395ed600ed39622796b41.exe	28
PID 1932 wrote to memory of 1452	1932	52c666c663f7f89999a3c812b02f248dda0719c0b7d395ed600ed39622796b41.exe	28

C:\Users\Admin\AppData\Local\Temp\52c666c663f7f89999a3c812b02f248dda0719c0b7d395ed600ed39622796b41.exe
"C:\Users\Admin\AppData\Local\Temp\52c666c663f7f89999a3c812b02f248dda0719c0b7d395ed600ed39622796b41.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 188
  2⤵
  - Program crash
  PID:1452