c62b78707c36428202251349d95ca42a5c2eeee9d4f75329ed0eaa2fecab59cf

Analysis

max time kernel
127s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 14:41

Target

c62b78707c36428202251349d95ca42a5c2eeee9d4f75329ed0eaa2fecab59cf.exe
Size

30KB
MD5

626e3be2e54806ce211505d05f3b5705
SHA1

65c95781ea64032a4e0e0fccdd2de5af3ae85fbe
SHA256

c62b78707c36428202251349d95ca42a5c2eeee9d4f75329ed0eaa2fecab59cf
SHA512

5ff3682362531153d063347369a966b3bbd663d261a6c4e973942e4189a8d2bdb258b6eefb99efbe4a2d5374915ee8093d6236379f61f4e75dd6dbde21c375ac
SSDEEP

384:cB6/oFQ7AhDGvgMO7U1VN+uXL7SkjkKqu3pLqG1a/9Tt:cB6/AnEO7juX/qKX3IMa/9Tt

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4960	4764	WerFault.exe	27
396	4764	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4764	c62b78707c36428202251349d95ca42a5c2eeee9d4f75329ed0eaa2fecab59cf.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4960	4764	c62b78707c36428202251349d95ca42a5c2eeee9d4f75329ed0eaa2fecab59cf.exe	86
PID 4764 wrote to memory of 4960	4764	c62b78707c36428202251349d95ca42a5c2eeee9d4f75329ed0eaa2fecab59cf.exe	86
PID 4764 wrote to memory of 4960	4764	c62b78707c36428202251349d95ca42a5c2eeee9d4f75329ed0eaa2fecab59cf.exe	86

C:\Users\Admin\AppData\Local\Temp\c62b78707c36428202251349d95ca42a5c2eeee9d4f75329ed0eaa2fecab59cf.exe
"C:\Users\Admin\AppData\Local\Temp\c62b78707c36428202251349d95ca42a5c2eeee9d4f75329ed0eaa2fecab59cf.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 664
  2⤵
  - Program crash
  PID:4960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 664
  2⤵
  - Program crash
  PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4764 -ip 4764
1⤵
PID:3444