d1247f2a9034a20206765853dca3cff9fef85ab2ad14d4439fcc7b28efcb702a

Analysis

max time kernel
36s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 00:04

Target

d1247f2a9034a20206765853dca3cff9fef85ab2ad14d4439fcc7b28efcb702a.exe
Size

28KB
MD5

0937e8bfb224c48772eb491c12bc3147
SHA1

48fcb29e2c864f93b7cfd42784d87fbb6edd271d
SHA256

d1247f2a9034a20206765853dca3cff9fef85ab2ad14d4439fcc7b28efcb702a
SHA512

4c92fa1f92c500ece88dee0f418aadcc962d1a8d71d09eba197a613a57e0eaf54ed8cfa4a58ad0b1fca92e9bbfc7d852a24b287341fdd647ff8bd571c8447e75
SSDEEP

384:JD6k7VN74ayUEG++xQmLsQUHhdREUa/tFp+tKPD/Z9:0Q774ayKnsZBna4t4/z

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
968	1388	WerFault.exe	25

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1388	d1247f2a9034a20206765853dca3cff9fef85ab2ad14d4439fcc7b28efcb702a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 968	1388	d1247f2a9034a20206765853dca3cff9fef85ab2ad14d4439fcc7b28efcb702a.exe	26
PID 1388 wrote to memory of 968	1388	d1247f2a9034a20206765853dca3cff9fef85ab2ad14d4439fcc7b28efcb702a.exe	26
PID 1388 wrote to memory of 968	1388	d1247f2a9034a20206765853dca3cff9fef85ab2ad14d4439fcc7b28efcb702a.exe	26
PID 1388 wrote to memory of 968	1388	d1247f2a9034a20206765853dca3cff9fef85ab2ad14d4439fcc7b28efcb702a.exe	26

C:\Users\Admin\AppData\Local\Temp\d1247f2a9034a20206765853dca3cff9fef85ab2ad14d4439fcc7b28efcb702a.exe
"C:\Users\Admin\AppData\Local\Temp\d1247f2a9034a20206765853dca3cff9fef85ab2ad14d4439fcc7b28efcb702a.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 188
  2⤵
  - Program crash
  PID:968

memory/1388-54-0x00000000002E0000-0x00000000002F0000-memory.dmp

Filesize
64KB

Download
memory/1388-55-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/1388-56-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/1388-57-0x0000000000320000-0x0000000000330000-memory.dmp

Filesize
64KB

Download
memory/1388-58-0x0000000000330000-0x0000000000340000-memory.dmp

Filesize
64KB

Download
memory/1388-59-0x0000000000340000-0x0000000000350000-memory.dmp

Filesize
64KB

Download
memory/1388-60-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/1388-61-0x0000000000360000-0x0000000000370000-memory.dmp

Filesize
64KB

Download
memory/1388-62-0x0000000000370000-0x0000000000380000-memory.dmp

Filesize
64KB

Download