ace8bf659a4681ca0c2494f7d6be08f6443eb439a32b28ce50e475272d93bd69

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 00:41

Target

ace8bf659a4681ca0c2494f7d6be08f6443eb439a32b28ce50e475272d93bd69.exe
Size

224KB
MD5

028b42fdce584bdd16a9fef5b9936cc4
SHA1

124697252ea4f6d34727e8f4913dba27679f9862
SHA256

ace8bf659a4681ca0c2494f7d6be08f6443eb439a32b28ce50e475272d93bd69
SHA512

1e1eae6abc6cbc10d81009d218d364face791354ce326915ccb3768f7be3c7359c1ed960c374e7d76a3ed4d5c4770a398abf823c066e52e7f37402fad1a393a2
SSDEEP

6144:4fZrLULmk3Uv5KKN0HOO6NYUzASgodcZ0TCxenNLpuScVdDxM:4f5UuYIAN0TkeNLpTYD6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
948	1048	WerFault.exe	26

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1048	ace8bf659a4681ca0c2494f7d6be08f6443eb439a32b28ce50e475272d93bd69.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 948	1048	ace8bf659a4681ca0c2494f7d6be08f6443eb439a32b28ce50e475272d93bd69.exe	27
PID 1048 wrote to memory of 948	1048	ace8bf659a4681ca0c2494f7d6be08f6443eb439a32b28ce50e475272d93bd69.exe	27
PID 1048 wrote to memory of 948	1048	ace8bf659a4681ca0c2494f7d6be08f6443eb439a32b28ce50e475272d93bd69.exe	27
PID 1048 wrote to memory of 948	1048	ace8bf659a4681ca0c2494f7d6be08f6443eb439a32b28ce50e475272d93bd69.exe	27

C:\Users\Admin\AppData\Local\Temp\ace8bf659a4681ca0c2494f7d6be08f6443eb439a32b28ce50e475272d93bd69.exe
"C:\Users\Admin\AppData\Local\Temp\ace8bf659a4681ca0c2494f7d6be08f6443eb439a32b28ce50e475272d93bd69.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 188
  2⤵
  - Program crash
  PID:948