7e0c0805e0e43fef8425aab04958599191addd749aa384fe8a9f36f0228126a2

Analysis

max time kernel
35s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 14:57

Target

7e0c0805e0e43fef8425aab04958599191addd749aa384fe8a9f36f0228126a2.exe
Size

72KB
MD5

45a4443d7136d12ceb0e379bff4505e5
SHA1

4a1b521a8ed7f47063436dc772204431dc98b0c2
SHA256

7e0c0805e0e43fef8425aab04958599191addd749aa384fe8a9f36f0228126a2
SHA512

d61064f3dc608af00aa664b1c17260a667dd39723892b48166d2643bf986761ff8b9772655257f24ebf3f02ea73f050d2fd25cee80d640b4c6098e226b203053
SSDEEP

1536:vu+hjRou5tGEK9cuYtWhiuRxYnc8O+jnLik4:vu+WhiuRxYcsnr4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1504	1776	WerFault.exe	14

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1776	7e0c0805e0e43fef8425aab04958599191addd749aa384fe8a9f36f0228126a2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1504	1776	7e0c0805e0e43fef8425aab04958599191addd749aa384fe8a9f36f0228126a2.exe	27
PID 1776 wrote to memory of 1504	1776	7e0c0805e0e43fef8425aab04958599191addd749aa384fe8a9f36f0228126a2.exe	27
PID 1776 wrote to memory of 1504	1776	7e0c0805e0e43fef8425aab04958599191addd749aa384fe8a9f36f0228126a2.exe	27
PID 1776 wrote to memory of 1504	1776	7e0c0805e0e43fef8425aab04958599191addd749aa384fe8a9f36f0228126a2.exe	27

C:\Users\Admin\AppData\Local\Temp\7e0c0805e0e43fef8425aab04958599191addd749aa384fe8a9f36f0228126a2.exe
"C:\Users\Admin\AppData\Local\Temp\7e0c0805e0e43fef8425aab04958599191addd749aa384fe8a9f36f0228126a2.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 244
  2⤵
  - Program crash
  PID:1504