c4d235cf1c9bb0712a8d1cdb1383be3b5e7623f961f3b51c25131560b99088bc

Analysis

max time kernel
30s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 02:57

Target

c4d235cf1c9bb0712a8d1cdb1383be3b5e7623f961f3b51c25131560b99088bc.exe
Size

76KB
MD5

59c618ca11a8901c1eae0b6c06f26181
SHA1

722b3f0be258d897b37539b75c4fc09f868b1c3b
SHA256

c4d235cf1c9bb0712a8d1cdb1383be3b5e7623f961f3b51c25131560b99088bc
SHA512

fbafd8f6eba660320ddfbcccc12c8766615d561fc167dbda1c08991a1b1f044b4ed7284a793e836569e6abedfd84b3a391ed7326de8b70fa4380a192e5377d37
SSDEEP

1536:8v/qaXRZ4kj8O+y6fg3LWJ2VQZ+k/izoPClKAMb:8v/qoRIbtmhoKsAMb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	1648	WerFault.exe	19

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1648	c4d235cf1c9bb0712a8d1cdb1383be3b5e7623f961f3b51c25131560b99088bc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2028	1648	c4d235cf1c9bb0712a8d1cdb1383be3b5e7623f961f3b51c25131560b99088bc.exe	28
PID 1648 wrote to memory of 2028	1648	c4d235cf1c9bb0712a8d1cdb1383be3b5e7623f961f3b51c25131560b99088bc.exe	28
PID 1648 wrote to memory of 2028	1648	c4d235cf1c9bb0712a8d1cdb1383be3b5e7623f961f3b51c25131560b99088bc.exe	28
PID 1648 wrote to memory of 2028	1648	c4d235cf1c9bb0712a8d1cdb1383be3b5e7623f961f3b51c25131560b99088bc.exe	28

C:\Users\Admin\AppData\Local\Temp\c4d235cf1c9bb0712a8d1cdb1383be3b5e7623f961f3b51c25131560b99088bc.exe
"C:\Users\Admin\AppData\Local\Temp\c4d235cf1c9bb0712a8d1cdb1383be3b5e7623f961f3b51c25131560b99088bc.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 188
  2⤵
  - Program crash
  PID:2028