d7dfeb3a01e365e91a021099cfccb964b0cd370fcc67067d9cd6e748abae8b59

Analysis

max time kernel
168s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 00:53

Target

d7dfeb3a01e365e91a021099cfccb964b0cd370fcc67067d9cd6e748abae8b59.exe
Size

208KB
MD5

0dfcd6d9a55f26fc1c22a5a9d5e774e0
SHA1

cb9ad745a545c8f36daa80cd5b28b0119648ea82
SHA256

d7dfeb3a01e365e91a021099cfccb964b0cd370fcc67067d9cd6e748abae8b59
SHA512

c1dff8be6c90ca8fe280b5af242a9510ce72bf38d03cca2e95f6fbf90fba55b3d70e42a1718a29e779cdc2bb0d34ae53ab48c26044472ef768ec20da76c09af5
SSDEEP

1536:Vfuxw10lxJM5y8w5OZRVmgyDl+cWaxJcveQZNTRSb3EBAR1AlQPsxjheYhpXN5yh:f0OtF2Qo7VsJgisxlYegEX0ZZbW

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3588	5116	WerFault.exe	79
5044	5116	WerFault.exe	79

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5116	d7dfeb3a01e365e91a021099cfccb964b0cd370fcc67067d9cd6e748abae8b59.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 3588	5116	d7dfeb3a01e365e91a021099cfccb964b0cd370fcc67067d9cd6e748abae8b59.exe	84
PID 5116 wrote to memory of 3588	5116	d7dfeb3a01e365e91a021099cfccb964b0cd370fcc67067d9cd6e748abae8b59.exe	84
PID 5116 wrote to memory of 3588	5116	d7dfeb3a01e365e91a021099cfccb964b0cd370fcc67067d9cd6e748abae8b59.exe	84

C:\Users\Admin\AppData\Local\Temp\d7dfeb3a01e365e91a021099cfccb964b0cd370fcc67067d9cd6e748abae8b59.exe
"C:\Users\Admin\AppData\Local\Temp\d7dfeb3a01e365e91a021099cfccb964b0cd370fcc67067d9cd6e748abae8b59.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 472
  2⤵
  - Program crash
  PID:3588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 472
  2⤵
  - Program crash
  PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5116 -ip 5116
1⤵
PID:3304