46973e97d801761a4ea1cc3ef79b06bf94e96d8e30b8b4c4beee66ed0ec85766

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 16:16

Target

46973e97d801761a4ea1cc3ef79b06bf94e96d8e30b8b4c4beee66ed0ec85766.exe
Size

84KB
MD5

63a2b4cfe667a5aa3cd621850f720d7e
SHA1

2802e583c485a7b51e487c17d30312f7c6763ba2
SHA256

46973e97d801761a4ea1cc3ef79b06bf94e96d8e30b8b4c4beee66ed0ec85766
SHA512

2cf27c5f2dcf7431f3b8e6c32766fbc0cd8c8dae5c290717a4e76acb801bdc767b29d25dd039403075a1bccc06bc6fa7c29302f3ffcc871c6e049d2de7368272
SSDEEP

768:Ru/HdK9sPnKMKIpXe04H7cHPHYmug6UXQm1dIZE2ocOT77e:RCKMKJHyj6S3T77

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1812	364	WerFault.exe	25

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
364	46973e97d801761a4ea1cc3ef79b06bf94e96d8e30b8b4c4beee66ed0ec85766.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1812	364	46973e97d801761a4ea1cc3ef79b06bf94e96d8e30b8b4c4beee66ed0ec85766.exe	26
PID 364 wrote to memory of 1812	364	46973e97d801761a4ea1cc3ef79b06bf94e96d8e30b8b4c4beee66ed0ec85766.exe	26
PID 364 wrote to memory of 1812	364	46973e97d801761a4ea1cc3ef79b06bf94e96d8e30b8b4c4beee66ed0ec85766.exe	26
PID 364 wrote to memory of 1812	364	46973e97d801761a4ea1cc3ef79b06bf94e96d8e30b8b4c4beee66ed0ec85766.exe	26

C:\Users\Admin\AppData\Local\Temp\46973e97d801761a4ea1cc3ef79b06bf94e96d8e30b8b4c4beee66ed0ec85766.exe
"C:\Users\Admin\AppData\Local\Temp\46973e97d801761a4ea1cc3ef79b06bf94e96d8e30b8b4c4beee66ed0ec85766.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 364 -s 188
  2⤵
  - Program crash
  PID:1812

memory/364-55-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download