cfd89c730aab2a71923c100123b69684f8891295799332eb47f7339d58b4b58e

Analysis

max time kernel
38s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:57

Target

cfd89c730aab2a71923c100123b69684f8891295799332eb47f7339d58b4b58e.exe
Size

160KB
MD5

5252da12e78d0ddf6131eb57f46793a0
SHA1

15e4dc28fd6638077333b7c319d30a0d8c36bbb3
SHA256

cfd89c730aab2a71923c100123b69684f8891295799332eb47f7339d58b4b58e
SHA512

b9abc6334ce99d0cecbc349273ec7e40d174a5205ea20e59bc3047073c26b5958556befa175dd74ba85fb29d9131ad110708694b38af1fd2d59b4028018e15a5
SSDEEP

3072:Va5Xf+DxG95Fbr2IsJ03CwLYwR49hPLd3BzK02Swq4lV34oQZiEV2P:k5v+DmbrTw03rLlR4PLnh7w1rZWC

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1072 652 WerFault.exe cfd89c730aab2a71923c100123b69684f8891295799332eb47f7339d58b4b58e.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

cfd89c730aab2a71923c100123b69684f8891295799332eb47f7339d58b4b58e.exe

pid process

652 cfd89c730aab2a71923c100123b69684f8891295799332eb47f7339d58b4b58e.exe

pid	pid_target	process	target process
1072	652	WerFault.exe	cfd89c730aab2a71923c100123b69684f8891295799332eb47f7339d58b4b58e.exe

pid	process
652	cfd89c730aab2a71923c100123b69684f8891295799332eb47f7339d58b4b58e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cfd89c730aab2a71923c100123b69684f8891295799332eb47f7339d58b4b58e.exe

description	pid	process	target process
PID 652 wrote to memory of 1072	652	cfd89c730aab2a71923c100123b69684f8891295799332eb47f7339d58b4b58e.exe	WerFault.exe
PID 652 wrote to memory of 1072	652	cfd89c730aab2a71923c100123b69684f8891295799332eb47f7339d58b4b58e.exe	WerFault.exe
PID 652 wrote to memory of 1072	652	cfd89c730aab2a71923c100123b69684f8891295799332eb47f7339d58b4b58e.exe	WerFault.exe
PID 652 wrote to memory of 1072	652	cfd89c730aab2a71923c100123b69684f8891295799332eb47f7339d58b4b58e.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 188
2⤵
- Program crash
PID:1072

memory/652-57-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1072-56-0x0000000000000000-mapping.dmp

Download