85427158041469051f0a36e57d1dcb179e039b775ee9f0133364b1e6ca36612b

Analysis

max time kernel
39s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:47

Target

85427158041469051f0a36e57d1dcb179e039b775ee9f0133364b1e6ca36612b.exe
Size

368KB
MD5

fce580911f4375249ee13fa459b9bd29
SHA1

8d78646722e2043bfeca9ad007e53e7eb3ed9c46
SHA256

85427158041469051f0a36e57d1dcb179e039b775ee9f0133364b1e6ca36612b
SHA512

a4c060396b2869e535f4732d52f225bcb55d173de123ef25751230299920b113c0095b9a9eac4e329798d19b043574c232f5e45093ef913b64e274dbcf120641
SSDEEP

6144:Bc9iwdbXP4g03ST50lMA5CJZXM1SdFa4MYYoebrJCyt8fgz2v:a9iwdr413ST50wc1SXuBJCyI4W

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1744 1488 WerFault.exe 85427158041469051f0a36e57d1dcb179e039b775ee9f0133364b1e6ca36612b.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

85427158041469051f0a36e57d1dcb179e039b775ee9f0133364b1e6ca36612b.exe

pid process

1488 85427158041469051f0a36e57d1dcb179e039b775ee9f0133364b1e6ca36612b.exe

pid	pid_target	process	target process
1744	1488	WerFault.exe	85427158041469051f0a36e57d1dcb179e039b775ee9f0133364b1e6ca36612b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

85427158041469051f0a36e57d1dcb179e039b775ee9f0133364b1e6ca36612b.exe

pid	process
1488	85427158041469051f0a36e57d1dcb179e039b775ee9f0133364b1e6ca36612b.exe
1488	85427158041469051f0a36e57d1dcb179e039b775ee9f0133364b1e6ca36612b.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

85427158041469051f0a36e57d1dcb179e039b775ee9f0133364b1e6ca36612b.exe

description	pid	process	target process
PID 1488 wrote to memory of 1744	1488	85427158041469051f0a36e57d1dcb179e039b775ee9f0133364b1e6ca36612b.exe	WerFault.exe
PID 1488 wrote to memory of 1744	1488	85427158041469051f0a36e57d1dcb179e039b775ee9f0133364b1e6ca36612b.exe	WerFault.exe
PID 1488 wrote to memory of 1744	1488	85427158041469051f0a36e57d1dcb179e039b775ee9f0133364b1e6ca36612b.exe	WerFault.exe
PID 1488 wrote to memory of 1744	1488	85427158041469051f0a36e57d1dcb179e039b775ee9f0133364b1e6ca36612b.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 252
2⤵
- Program crash
PID:1744

memory/1488-54-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Filesize
8KB

Download
memory/1488-56-0x0000000000320000-0x0000000000324000-memory.dmp

Filesize
16KB

Download
memory/1744-55-0x0000000000000000-mapping.dmp

Download