76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773

Analysis

max time kernel
28s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:06

Target

76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773.exe
Size

56KB
MD5

53652d0d35cedc9f2385a6deeb7e3891
SHA1

7c07f23a2fe8fbeba947e9f1db5439b0b47553af
SHA256

76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773
SHA512

67bcf5435feecd54156947820c95dcae25b7d50c4d1cdc3c888f7460597c854f28d635a9c8c0ccfd24206e8ef2880f7f134c4e58ad350a1f7cb4c4a5ec9aec05
SSDEEP

1536:Sc0c9XQgnRt9UdLw6BNMyBhXZxHJ6P6D5b:ggz07JjD5b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1756 1964 WerFault.exe 76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773.exe

pid process

1964 76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773.exe

pid	pid_target	process	target process
1756	1964	WerFault.exe	76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773.exe

pid	process
1964	76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773.exe

description	pid	process	target process
PID 1964 wrote to memory of 1756	1964	76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773.exe	WerFault.exe
PID 1964 wrote to memory of 1756	1964	76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773.exe	WerFault.exe
PID 1964 wrote to memory of 1756	1964	76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773.exe	WerFault.exe
PID 1964 wrote to memory of 1756	1964	76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 220
2⤵
- Program crash
PID:1756