6b8dcfa9d723295940af2cf5cd5f752ebf77f2965230f2c0b438e8cafcde1896

Analysis

max time kernel
26s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 14:24

Target

6b8dcfa9d723295940af2cf5cd5f752ebf77f2965230f2c0b438e8cafcde1896.exe
Size

228KB
MD5

458df2285f868d48de1f4765b23d9136
SHA1

bcb6528c07cc6a79e06ae30c640555286d50d203
SHA256

6b8dcfa9d723295940af2cf5cd5f752ebf77f2965230f2c0b438e8cafcde1896
SHA512

2b5dcf953c869f9c93a4f84f2560537f796496a51a57efd21b66842173f4a27273bd8acefffc62eb6a88c7fd9820853066e1989d77c67f6101913d3764d2dc83
SSDEEP

6144:mS46KG6JFjCCSC4Ojj1Pk1Lr0IU0QHm8ySu:mSbKFJ8Y4OH1M1LHU0QHh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1788	1848	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1848	6b8dcfa9d723295940af2cf5cd5f752ebf77f2965230f2c0b438e8cafcde1896.exe
1848	6b8dcfa9d723295940af2cf5cd5f752ebf77f2965230f2c0b438e8cafcde1896.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 1788	1848	6b8dcfa9d723295940af2cf5cd5f752ebf77f2965230f2c0b438e8cafcde1896.exe	28
PID 1848 wrote to memory of 1788	1848	6b8dcfa9d723295940af2cf5cd5f752ebf77f2965230f2c0b438e8cafcde1896.exe	28
PID 1848 wrote to memory of 1788	1848	6b8dcfa9d723295940af2cf5cd5f752ebf77f2965230f2c0b438e8cafcde1896.exe	28
PID 1848 wrote to memory of 1788	1848	6b8dcfa9d723295940af2cf5cd5f752ebf77f2965230f2c0b438e8cafcde1896.exe	28

C:\Users\Admin\AppData\Local\Temp\6b8dcfa9d723295940af2cf5cd5f752ebf77f2965230f2c0b438e8cafcde1896.exe
"C:\Users\Admin\AppData\Local\Temp\6b8dcfa9d723295940af2cf5cd5f752ebf77f2965230f2c0b438e8cafcde1896.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 304
  2⤵
  - Program crash
  PID:1788

memory/1848-54-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download
memory/1848-57-0x00000000002C0000-0x00000000002F8000-memory.dmp

Filesize
224KB

Download
memory/1848-56-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download