d13bc2f3f95c40a05f4b3c2bf67972350d05127e9a497c71b18f1076e8d20319

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 00:38

Target

d13bc2f3f95c40a05f4b3c2bf67972350d05127e9a497c71b18f1076e8d20319.exe
Size

156KB
MD5

556477277c4e38ada4a5582c538b8590
SHA1

7649616618517e406ff2a53a5b92d23a804ff665
SHA256

d13bc2f3f95c40a05f4b3c2bf67972350d05127e9a497c71b18f1076e8d20319
SHA512

55d6a8442a08ffaeee197682fda1ee6228c2568c4625c0694b2d402e06b7f3066aed7ffc6ba4b3b196dc38584e63e52589fb7bf3ea01c430bc5fc165dac87dc7
SSDEEP

3072:7AjcTATe0pBI1xkaGU0vBpT8k/QvbawuxtUYqBd5hAmamQAMHfhRvuWxx0h4oQZg:78c4e0pBI1xkaH0vBpT8kltDr8L5DMHa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1312	1720	WerFault.exe	26

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1720	d13bc2f3f95c40a05f4b3c2bf67972350d05127e9a497c71b18f1076e8d20319.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1312	1720	d13bc2f3f95c40a05f4b3c2bf67972350d05127e9a497c71b18f1076e8d20319.exe	27
PID 1720 wrote to memory of 1312	1720	d13bc2f3f95c40a05f4b3c2bf67972350d05127e9a497c71b18f1076e8d20319.exe	27
PID 1720 wrote to memory of 1312	1720	d13bc2f3f95c40a05f4b3c2bf67972350d05127e9a497c71b18f1076e8d20319.exe	27
PID 1720 wrote to memory of 1312	1720	d13bc2f3f95c40a05f4b3c2bf67972350d05127e9a497c71b18f1076e8d20319.exe	27

C:\Users\Admin\AppData\Local\Temp\d13bc2f3f95c40a05f4b3c2bf67972350d05127e9a497c71b18f1076e8d20319.exe
"C:\Users\Admin\AppData\Local\Temp\d13bc2f3f95c40a05f4b3c2bf67972350d05127e9a497c71b18f1076e8d20319.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 188
  2⤵
  - Program crash
  PID:1312