7e3fd50b82d75392eedda4af5f2dda297beea922b772a541b8b5c6f97603c0c7

Analysis

max time kernel
38s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 19:01

Target

7e3fd50b82d75392eedda4af5f2dda297beea922b772a541b8b5c6f97603c0c7.exe
Size

156KB
MD5

52ba738ce50fc34ac6d8d9da7f781f90
SHA1

a9fe8d5caacaf493d0b5648f7c0b679e7bcff22e
SHA256

7e3fd50b82d75392eedda4af5f2dda297beea922b772a541b8b5c6f97603c0c7
SHA512

29ccf2f5462a41b56ac810ef211c0f9a26e4d1483e9e68849d50f63d9656c624595f96e0665678aa52b5b8524d15c64fff4266c42f4dbebf4cf2456ed7be57ca
SSDEEP

3072:PNMtMS4aZhJdxKPE+vgu36MN9vqKyHjm6I1JDVOc2k4oQZiEaL:nm7d0zvhqMN9vgjm6ILDVOSW8

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1016 1352 WerFault.exe 7e3fd50b82d75392eedda4af5f2dda297beea922b772a541b8b5c6f97603c0c7.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

7e3fd50b82d75392eedda4af5f2dda297beea922b772a541b8b5c6f97603c0c7.exe

pid process

1352 7e3fd50b82d75392eedda4af5f2dda297beea922b772a541b8b5c6f97603c0c7.exe

pid	pid_target	process	target process
1016	1352	WerFault.exe	7e3fd50b82d75392eedda4af5f2dda297beea922b772a541b8b5c6f97603c0c7.exe

pid	process
1352	7e3fd50b82d75392eedda4af5f2dda297beea922b772a541b8b5c6f97603c0c7.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7e3fd50b82d75392eedda4af5f2dda297beea922b772a541b8b5c6f97603c0c7.exe

description	pid	process	target process
PID 1352 wrote to memory of 1016	1352	7e3fd50b82d75392eedda4af5f2dda297beea922b772a541b8b5c6f97603c0c7.exe	WerFault.exe
PID 1352 wrote to memory of 1016	1352	7e3fd50b82d75392eedda4af5f2dda297beea922b772a541b8b5c6f97603c0c7.exe	WerFault.exe
PID 1352 wrote to memory of 1016	1352	7e3fd50b82d75392eedda4af5f2dda297beea922b772a541b8b5c6f97603c0c7.exe	WerFault.exe
PID 1352 wrote to memory of 1016	1352	7e3fd50b82d75392eedda4af5f2dda297beea922b772a541b8b5c6f97603c0c7.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 188
2⤵
- Program crash
PID:1016