5f41c01cac3ac12d87d03ff3ce9f565cf4fd7ba78bb694d7a586272b826b2b4e

Analysis

max time kernel
144s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 05:14

Target

5f41c01cac3ac12d87d03ff3ce9f565cf4fd7ba78bb694d7a586272b826b2b4e.exe
Size

33KB
MD5

816fb0cdb089b31827042a2bcc5e3a10
SHA1

e1b19d5f63c871a7d56832cb2d0c92c9428a3885
SHA256

5f41c01cac3ac12d87d03ff3ce9f565cf4fd7ba78bb694d7a586272b826b2b4e
SHA512

bac33369a160c6e5a1a2905174a91df5b22d83775d2a4f7ce2c352d9195f3a9a9f11f3124cb8661d65db58230be9d287dd9b49734c46dc7b1d5d2346a2be6846
SSDEEP

384:ZswIquq1dVRMKpUgqsJGE2bh0nCWSynIxLT6aXLA0JvOfEdSYEeThU:uwIquqHVpWsCbkIL+mAe4EkDe+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2548	5044	WerFault.exe	80

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5044	5f41c01cac3ac12d87d03ff3ce9f565cf4fd7ba78bb694d7a586272b826b2b4e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 2548	5044	5f41c01cac3ac12d87d03ff3ce9f565cf4fd7ba78bb694d7a586272b826b2b4e.exe	83
PID 5044 wrote to memory of 2548	5044	5f41c01cac3ac12d87d03ff3ce9f565cf4fd7ba78bb694d7a586272b826b2b4e.exe	83
PID 5044 wrote to memory of 2548	5044	5f41c01cac3ac12d87d03ff3ce9f565cf4fd7ba78bb694d7a586272b826b2b4e.exe	83

C:\Users\Admin\AppData\Local\Temp\5f41c01cac3ac12d87d03ff3ce9f565cf4fd7ba78bb694d7a586272b826b2b4e.exe
"C:\Users\Admin\AppData\Local\Temp\5f41c01cac3ac12d87d03ff3ce9f565cf4fd7ba78bb694d7a586272b826b2b4e.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 468
  2⤵
  - Program crash
  PID:2548