7b559ad888609d0316271a611324d0e49b1e39857cd0daa607a4ea9f1ef50920

Analysis

max time kernel
147s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 03:49

Target

7b559ad888609d0316271a611324d0e49b1e39857cd0daa607a4ea9f1ef50920.exe
Size

35KB
MD5

4bdddfc56d1ae5a96c121fb70758fa70
SHA1

cea4efa5264d48d47cffbd55a25789cf6ea1e99e
SHA256

7b559ad888609d0316271a611324d0e49b1e39857cd0daa607a4ea9f1ef50920
SHA512

8406efda290292e766db50d2d9f6924c7c3d300b67eb3833b60488e8e0ccad234b7023a7b2f129fe531622353a9042193ab3974793692d1cacbd449208471087
SSDEEP

384:IOTUm2+Y+H75oESRT6lp9eME7H1VcO5k087OqcXcEDrHOd1wKkUgRA9eRZ:IOQd+YShqja087OqcB2EUgRMOZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4992	2988	WerFault.exe	71

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2988	7b559ad888609d0316271a611324d0e49b1e39857cd0daa607a4ea9f1ef50920.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 4992	2988	7b559ad888609d0316271a611324d0e49b1e39857cd0daa607a4ea9f1ef50920.exe	84
PID 2988 wrote to memory of 4992	2988	7b559ad888609d0316271a611324d0e49b1e39857cd0daa607a4ea9f1ef50920.exe	84
PID 2988 wrote to memory of 4992	2988	7b559ad888609d0316271a611324d0e49b1e39857cd0daa607a4ea9f1ef50920.exe	84

C:\Users\Admin\AppData\Local\Temp\7b559ad888609d0316271a611324d0e49b1e39857cd0daa607a4ea9f1ef50920.exe
"C:\Users\Admin\AppData\Local\Temp\7b559ad888609d0316271a611324d0e49b1e39857cd0daa607a4ea9f1ef50920.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 464
  2⤵
  - Program crash
  PID:4992