36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4

Analysis

max time kernel
16s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 19:57

Target

36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe
Size

299KB
MD5

3f38c5790ae830a0dee41dcb932f8a6e
SHA1

00d9945ee514191f7533dd9dca97e126f6bc6fd3
SHA256

36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4
SHA512

a86e3a74c9c5d71314bfc7113d6a9d4c1282bff0c9aa7a17cbe4f4338b85c1e7be4d67baed5d283b2086fce0b8243b1047f21f162e92a037b0c82381d36039a3
SSDEEP

6144:T1JyF+1ApsZPrnLSnfeb7n4rhK1SraH8cu9nN6c:T1LAmLSnf27YK1iO83

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1724	1684	WerFault.exe	23

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1684	36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1684	36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1724	1684	36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe	28
PID 1684 wrote to memory of 1724	1684	36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe	28
PID 1684 wrote to memory of 1724	1684	36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe	28
PID 1684 wrote to memory of 1724	1684	36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe	28

C:\Users\Admin\AppData\Local\Temp\36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe
"C:\Users\Admin\AppData\Local\Temp\36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 252
  2⤵
  - Program crash
  PID:1724

memory/1684-54-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download
memory/1684-56-0x0000000000280000-0x0000000000284000-memory.dmp

Filesize
16KB

Download