b0f0d0a88de878395a4b9f7596ade779eb762ba90c98f44198bf6218d50eb9c6

Analysis

max time kernel
23s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 07:22

Target

b0f0d0a88de878395a4b9f7596ade779eb762ba90c98f44198bf6218d50eb9c6.exe
Size

71KB
MD5

1657372d8ba4a01e43e89295e7ae23a6
SHA1

2738253cc0215b173a3fdf5d5f10294c1be3390c
SHA256

b0f0d0a88de878395a4b9f7596ade779eb762ba90c98f44198bf6218d50eb9c6
SHA512

8b4a6314eddeca7167d67d4a687fdd7db189c1fc2f3b2ad4c746d3dd9172669345f30aaeb851da584436e091dfbc29ee13a11fa2a69ebd22a0e0fd178ef26496
SSDEEP

1536:3L1RLeMZ/lJTTyDoAJF4UwoIAxGAcaeLiWvtwK5c7UmuD9TwYluul209JNd:3L1Ra4DXAJF4JoIAMTaeLi2NrRpND

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1608	1208	WerFault.exe	14

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1208	b0f0d0a88de878395a4b9f7596ade779eb762ba90c98f44198bf6218d50eb9c6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1608	1208	b0f0d0a88de878395a4b9f7596ade779eb762ba90c98f44198bf6218d50eb9c6.exe	28
PID 1208 wrote to memory of 1608	1208	b0f0d0a88de878395a4b9f7596ade779eb762ba90c98f44198bf6218d50eb9c6.exe	28
PID 1208 wrote to memory of 1608	1208	b0f0d0a88de878395a4b9f7596ade779eb762ba90c98f44198bf6218d50eb9c6.exe	28
PID 1208 wrote to memory of 1608	1208	b0f0d0a88de878395a4b9f7596ade779eb762ba90c98f44198bf6218d50eb9c6.exe	28

C:\Users\Admin\AppData\Local\Temp\b0f0d0a88de878395a4b9f7596ade779eb762ba90c98f44198bf6218d50eb9c6.exe
"C:\Users\Admin\AppData\Local\Temp\b0f0d0a88de878395a4b9f7596ade779eb762ba90c98f44198bf6218d50eb9c6.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 188
  2⤵
  - Program crash
  PID:1608

memory/1208-57-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/1608-56-0x0000000000000000-mapping.dmp

Download