4bff6daf0aae3da100ed7ca1bb48a06e85ebe8c5c3ca69a0179825b071c95c12

Analysis

max time kernel
159s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:51

Target

4bff6daf0aae3da100ed7ca1bb48a06e85ebe8c5c3ca69a0179825b071c95c12.exe
Size

53KB
MD5

4ff7b4c50a0f9106cf3cfd2d44de97a0
SHA1

27bf8acd6b26752070ae7a95d4589626cfd78e66
SHA256

4bff6daf0aae3da100ed7ca1bb48a06e85ebe8c5c3ca69a0179825b071c95c12
SHA512

788ab385dd4c92fddb5df058cac77eb2916068cbec9baabeb07114f830608e9cb4023846af30a6e3b76590ee69236e691d012cc0b1540dd5c25f1c400ae6c6db
SSDEEP

768:qivpm5wazR03BAornyV0pf1RiK/49OTr1mz5ONpjhkHIUJewOG:fvpmvl2nu0BxVAzUN1xge

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2628	1688	WerFault.exe	4bff6daf0aae3da100ed7ca1bb48a06e85ebe8c5c3ca69a0179825b071c95c12.exe
3760	1688	WerFault.exe	4bff6daf0aae3da100ed7ca1bb48a06e85ebe8c5c3ca69a0179825b071c95c12.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

4bff6daf0aae3da100ed7ca1bb48a06e85ebe8c5c3ca69a0179825b071c95c12.exe

pid process

1688 4bff6daf0aae3da100ed7ca1bb48a06e85ebe8c5c3ca69a0179825b071c95c12.exe

pid	process
1688	4bff6daf0aae3da100ed7ca1bb48a06e85ebe8c5c3ca69a0179825b071c95c12.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4bff6daf0aae3da100ed7ca1bb48a06e85ebe8c5c3ca69a0179825b071c95c12.exe

description	pid	process	target process
PID 1688 wrote to memory of 2628	1688	4bff6daf0aae3da100ed7ca1bb48a06e85ebe8c5c3ca69a0179825b071c95c12.exe	WerFault.exe
PID 1688 wrote to memory of 2628	1688	4bff6daf0aae3da100ed7ca1bb48a06e85ebe8c5c3ca69a0179825b071c95c12.exe	WerFault.exe
PID 1688 wrote to memory of 2628	1688	4bff6daf0aae3da100ed7ca1bb48a06e85ebe8c5c3ca69a0179825b071c95c12.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 492
2⤵
- Program crash
PID:2628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 492
2⤵
- Program crash
PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1688 -ip 1688
1⤵
PID:4688