41b3719f6edd47064edfd263a3afaee39341956582c45e1fe2f4e7e127fd4838

Analysis

max time kernel
94s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 02:11

Target

41b3719f6edd47064edfd263a3afaee39341956582c45e1fe2f4e7e127fd4838.exe
Size

82KB
MD5

6958068037ed95a6f3c78c007cf013f0
SHA1

795790f1b77b417c34d715c9c54dc2a76f9bc928
SHA256

41b3719f6edd47064edfd263a3afaee39341956582c45e1fe2f4e7e127fd4838
SHA512

8780221025686ef18be3e0e92936db23ed2c9005f6c9b63d524ecb0ede6b3432aa2a2bad6b8f729f73289d750bd2f106281f34234cf7b3c66d501a4f987e0f84
SSDEEP

1536:Dj28KTKXXuMVgVnzt/5/1G3cyHAbbfQnf2yVJW:SginzlR1fzbfQfn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4436	2212	WerFault.exe	80

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2212	41b3719f6edd47064edfd263a3afaee39341956582c45e1fe2f4e7e127fd4838.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 4436	2212	41b3719f6edd47064edfd263a3afaee39341956582c45e1fe2f4e7e127fd4838.exe	82
PID 2212 wrote to memory of 4436	2212	41b3719f6edd47064edfd263a3afaee39341956582c45e1fe2f4e7e127fd4838.exe	82
PID 2212 wrote to memory of 4436	2212	41b3719f6edd47064edfd263a3afaee39341956582c45e1fe2f4e7e127fd4838.exe	82

C:\Users\Admin\AppData\Local\Temp\41b3719f6edd47064edfd263a3afaee39341956582c45e1fe2f4e7e127fd4838.exe
"C:\Users\Admin\AppData\Local\Temp\41b3719f6edd47064edfd263a3afaee39341956582c45e1fe2f4e7e127fd4838.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 520
  2⤵
  - Program crash
  PID:4436