877c97b644ff93cbda33f41a20878d840e008fd4a41fa283a6897f9c5789035b

Analysis

max time kernel
153s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 16:16

Target

877c97b644ff93cbda33f41a20878d840e008fd4a41fa283a6897f9c5789035b.exe
Size

160KB
MD5

6e59fcb0c2c2a5c02daa1413f5092310
SHA1

74917617ce9d83d12fc73e2ab6bbd8e2a95a7b26
SHA256

877c97b644ff93cbda33f41a20878d840e008fd4a41fa283a6897f9c5789035b
SHA512

ae87bda425aef19f6cc6e3004c115687da05c53f71b735eef94dbeeb8ed630133c49bc9c902e157548f6ae84cde6dc0e00d051f830c6714f0b95a625653e666a
SSDEEP

1536:3+gDbKlmyJKz5jR7766dxocisPfDsCUjhe+SPBp9oEoTTLgY++++1sY+++++ZDdM:3xbkuVbvLn7Uj3

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4908	816	WerFault.exe	80
4956	816	WerFault.exe	80

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
816	877c97b644ff93cbda33f41a20878d840e008fd4a41fa283a6897f9c5789035b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 4908	816	877c97b644ff93cbda33f41a20878d840e008fd4a41fa283a6897f9c5789035b.exe	83
PID 816 wrote to memory of 4908	816	877c97b644ff93cbda33f41a20878d840e008fd4a41fa283a6897f9c5789035b.exe	83
PID 816 wrote to memory of 4908	816	877c97b644ff93cbda33f41a20878d840e008fd4a41fa283a6897f9c5789035b.exe	83

C:\Users\Admin\AppData\Local\Temp\877c97b644ff93cbda33f41a20878d840e008fd4a41fa283a6897f9c5789035b.exe
"C:\Users\Admin\AppData\Local\Temp\877c97b644ff93cbda33f41a20878d840e008fd4a41fa283a6897f9c5789035b.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 468
  2⤵
  - Program crash
  PID:4908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 468
  2⤵
  - Program crash
  PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 816 -ip 816
1⤵
PID:4352