ace8bf659a4681ca0c2494f7d6be08f6443eb439a32b28ce50e475272d93bd69

Analysis

max time kernel
130s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 00:41

Target

ace8bf659a4681ca0c2494f7d6be08f6443eb439a32b28ce50e475272d93bd69.exe
Size

224KB
MD5

028b42fdce584bdd16a9fef5b9936cc4
SHA1

124697252ea4f6d34727e8f4913dba27679f9862
SHA256

ace8bf659a4681ca0c2494f7d6be08f6443eb439a32b28ce50e475272d93bd69
SHA512

1e1eae6abc6cbc10d81009d218d364face791354ce326915ccb3768f7be3c7359c1ed960c374e7d76a3ed4d5c4770a398abf823c066e52e7f37402fad1a393a2
SSDEEP

6144:4fZrLULmk3Uv5KKN0HOO6NYUzASgodcZ0TCxenNLpuScVdDxM:4f5UuYIAN0TkeNLpTYD6

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
452	1380	WerFault.exe	78
220	1380	WerFault.exe	78

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1380	ace8bf659a4681ca0c2494f7d6be08f6443eb439a32b28ce50e475272d93bd69.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 452	1380	ace8bf659a4681ca0c2494f7d6be08f6443eb439a32b28ce50e475272d93bd69.exe	81
PID 1380 wrote to memory of 452	1380	ace8bf659a4681ca0c2494f7d6be08f6443eb439a32b28ce50e475272d93bd69.exe	81
PID 1380 wrote to memory of 452	1380	ace8bf659a4681ca0c2494f7d6be08f6443eb439a32b28ce50e475272d93bd69.exe	81

C:\Users\Admin\AppData\Local\Temp\ace8bf659a4681ca0c2494f7d6be08f6443eb439a32b28ce50e475272d93bd69.exe
"C:\Users\Admin\AppData\Local\Temp\ace8bf659a4681ca0c2494f7d6be08f6443eb439a32b28ce50e475272d93bd69.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 440
  2⤵
  - Program crash
  PID:452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 440
  2⤵
  - Program crash
  PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1380 -ip 1380
1⤵
PID:4236