0a616927889412185ae48792ffc01c896e025476c785828c24f3c19e5ff06cf0

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 05:34

Target

0a616927889412185ae48792ffc01c896e025476c785828c24f3c19e5ff06cf0.exe
Size

815KB
MD5

684d4e93226e7ba89d0a109cdc6a6090
SHA1

3e72834be9c2bd35834a3dee190c7b110948c49d
SHA256

0a616927889412185ae48792ffc01c896e025476c785828c24f3c19e5ff06cf0
SHA512

fc7bceb8473be36aa1179921b604708ebef9f7e027c812dc8c2295d37e06be0e997c50d2ecdf4f436fe7f4589e031f0a969c8bb27452736822dd59b72907c62a
SSDEEP

12288:TV8YunvWCjxdveyxKuImBiRoJzWYfwa0S5kKttavoKLOrDroqCaqxSsP2:58YunVDxKuPBiRail1Q+oKLufolhSo2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1748	1492	WerFault.exe	26

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1492	0a616927889412185ae48792ffc01c896e025476c785828c24f3c19e5ff06cf0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1748	1492	0a616927889412185ae48792ffc01c896e025476c785828c24f3c19e5ff06cf0.exe	27
PID 1492 wrote to memory of 1748	1492	0a616927889412185ae48792ffc01c896e025476c785828c24f3c19e5ff06cf0.exe	27
PID 1492 wrote to memory of 1748	1492	0a616927889412185ae48792ffc01c896e025476c785828c24f3c19e5ff06cf0.exe	27
PID 1492 wrote to memory of 1748	1492	0a616927889412185ae48792ffc01c896e025476c785828c24f3c19e5ff06cf0.exe	27

C:\Users\Admin\AppData\Local\Temp\0a616927889412185ae48792ffc01c896e025476c785828c24f3c19e5ff06cf0.exe
"C:\Users\Admin\AppData\Local\Temp\0a616927889412185ae48792ffc01c896e025476c785828c24f3c19e5ff06cf0.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 256
  2⤵
  - Program crash
  PID:1748

memory/1492-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1492-56-0x0000000000400000-0x0000000002C1D000-memory.dmp

Filesize
40.1MB

Download