abbafb04c15ce43ef9c7543ed7465407ca058e40882cbc82d56df18a22505350

Analysis

max time kernel
38s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 22:36

Target

abbafb04c15ce43ef9c7543ed7465407ca058e40882cbc82d56df18a22505350.exe
Size

72KB
MD5

387e2bec17804a5c65e5c717697e918f
SHA1

7950fbf03f00d81f28e2ead89353c8c7832685b0
SHA256

abbafb04c15ce43ef9c7543ed7465407ca058e40882cbc82d56df18a22505350
SHA512

b554264340cfe62df8fba51862f026d7aaf36228e9bf3b93e86d2ab559981128e885c63273171a8d02803d22e41159d6898d1904b0f2d44401215b96b7e0dadf
SSDEEP

1536:Jd+hjRou5tGEK9cuYtWhiuRxYnc8O+jnLik4:Jd+WhiuRxYcsnr4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1900	1228	WerFault.exe	26

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1228	abbafb04c15ce43ef9c7543ed7465407ca058e40882cbc82d56df18a22505350.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 1900	1228	abbafb04c15ce43ef9c7543ed7465407ca058e40882cbc82d56df18a22505350.exe	27
PID 1228 wrote to memory of 1900	1228	abbafb04c15ce43ef9c7543ed7465407ca058e40882cbc82d56df18a22505350.exe	27
PID 1228 wrote to memory of 1900	1228	abbafb04c15ce43ef9c7543ed7465407ca058e40882cbc82d56df18a22505350.exe	27
PID 1228 wrote to memory of 1900	1228	abbafb04c15ce43ef9c7543ed7465407ca058e40882cbc82d56df18a22505350.exe	27

C:\Users\Admin\AppData\Local\Temp\abbafb04c15ce43ef9c7543ed7465407ca058e40882cbc82d56df18a22505350.exe
"C:\Users\Admin\AppData\Local\Temp\abbafb04c15ce43ef9c7543ed7465407ca058e40882cbc82d56df18a22505350.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 244
  2⤵
  - Program crash
  PID:1900