682f100090bd75737e72aeab5f45ed9c2626d16b3f0d9103fe59e1b742769f5f

Analysis

max time kernel
154s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 08:42

Target

682f100090bd75737e72aeab5f45ed9c2626d16b3f0d9103fe59e1b742769f5f.exe
Size

236KB
MD5

5c1ce5c76bae30ed182a653771e28e50
SHA1

ba8f004cd3462ea155ef93f7f97c1357688cb70a
SHA256

682f100090bd75737e72aeab5f45ed9c2626d16b3f0d9103fe59e1b742769f5f
SHA512

de51bb9bf40b4d034e2bae70cad7c83eeab43cd52ab2ef53353c5a11cdf464d16e8058af2ecbda8d6224fb0858314fe012dd4c7f257a564e38cc5ea82a4ee071
SSDEEP

6144:FG0+Fs5lBlHlljoufLMHXtKBty9TS9zga:gNtSy5+zga

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1772	4816	WerFault.exe	83
2132	4816	WerFault.exe	83

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4816	682f100090bd75737e72aeab5f45ed9c2626d16b3f0d9103fe59e1b742769f5f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 2132	4816	682f100090bd75737e72aeab5f45ed9c2626d16b3f0d9103fe59e1b742769f5f.exe	87
PID 4816 wrote to memory of 2132	4816	682f100090bd75737e72aeab5f45ed9c2626d16b3f0d9103fe59e1b742769f5f.exe	87
PID 4816 wrote to memory of 2132	4816	682f100090bd75737e72aeab5f45ed9c2626d16b3f0d9103fe59e1b742769f5f.exe	87

C:\Users\Admin\AppData\Local\Temp\682f100090bd75737e72aeab5f45ed9c2626d16b3f0d9103fe59e1b742769f5f.exe
"C:\Users\Admin\AppData\Local\Temp\682f100090bd75737e72aeab5f45ed9c2626d16b3f0d9103fe59e1b742769f5f.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 468
  2⤵
  - Program crash
  PID:1772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 468
  2⤵
  - Program crash
  PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4816 -ip 4816
1⤵
PID:3956

memory/2132-137-0x0000000000000000-mapping.dmp

Download
memory/4816-134-0x0000000000662000-0x0000000000667000-memory.dmp

Filesize
20KB

Download
memory/4816-135-0x0000000000662000-0x0000000000667000-memory.dmp

Filesize
20KB

Download
memory/4816-136-0x0000000000671000-0x0000000000673000-memory.dmp

Filesize
8KB

Download