76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773

Analysis

max time kernel
155s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:06

Target

76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773.exe
Size

56KB
MD5

53652d0d35cedc9f2385a6deeb7e3891
SHA1

7c07f23a2fe8fbeba947e9f1db5439b0b47553af
SHA256

76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773
SHA512

67bcf5435feecd54156947820c95dcae25b7d50c4d1cdc3c888f7460597c854f28d635a9c8c0ccfd24206e8ef2880f7f134c4e58ad350a1f7cb4c4a5ec9aec05
SSDEEP

1536:Sc0c9XQgnRt9UdLw6BNMyBhXZxHJ6P6D5b:ggz07JjD5b

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
316	708	WerFault.exe	76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773.exe
1704	708	WerFault.exe	76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773.exe

pid process

708 76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773.exe

pid	process
708	76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773.exe

description	pid	process	target process
PID 708 wrote to memory of 316	708	76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773.exe	WerFault.exe
PID 708 wrote to memory of 316	708	76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773.exe	WerFault.exe
PID 708 wrote to memory of 316	708	76febc0627b24ceb0bb82d483f1425ca13458f5e2533e6da467bb9da5c312773.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 708 -s 508
2⤵
- Program crash
PID:316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 708 -s 508
2⤵
- Program crash
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 708 -ip 708
1⤵
PID:3604