13ca3e36c6b5abb3d16b9dd038bc8c5f7ae29b3da7fe42ebdbd517f961be7040

Analysis

max time kernel
3s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 19:43

Target

13ca3e36c6b5abb3d16b9dd038bc8c5f7ae29b3da7fe42ebdbd517f961be7040.exe
Size

156KB
MD5

44a75f23362e0271c54769f2dbda5560
SHA1

a462b4012d62c8409d57457e9f9b68828e92bbe6
SHA256

13ca3e36c6b5abb3d16b9dd038bc8c5f7ae29b3da7fe42ebdbd517f961be7040
SHA512

201f7a7ab31a7e374dc65ac17dcee2fa64492cda19eb2501a8d66a064e7212f886c666fa5f99cda4a7bf9b8913097e6062164a26d93820ba8a582f0db1b050ae
SSDEEP

3072:15/Cqj0C0H3RvXs45qlCG8v12aO1AwPgamPe42IZ54oQZiEzV2:rCW0Lvulf8v12aO1AwSPe4RxW94

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
960	1484	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1484	13ca3e36c6b5abb3d16b9dd038bc8c5f7ae29b3da7fe42ebdbd517f961be7040.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 960	1484	13ca3e36c6b5abb3d16b9dd038bc8c5f7ae29b3da7fe42ebdbd517f961be7040.exe	28
PID 1484 wrote to memory of 960	1484	13ca3e36c6b5abb3d16b9dd038bc8c5f7ae29b3da7fe42ebdbd517f961be7040.exe	28
PID 1484 wrote to memory of 960	1484	13ca3e36c6b5abb3d16b9dd038bc8c5f7ae29b3da7fe42ebdbd517f961be7040.exe	28
PID 1484 wrote to memory of 960	1484	13ca3e36c6b5abb3d16b9dd038bc8c5f7ae29b3da7fe42ebdbd517f961be7040.exe	28

C:\Users\Admin\AppData\Local\Temp\13ca3e36c6b5abb3d16b9dd038bc8c5f7ae29b3da7fe42ebdbd517f961be7040.exe
"C:\Users\Admin\AppData\Local\Temp\13ca3e36c6b5abb3d16b9dd038bc8c5f7ae29b3da7fe42ebdbd517f961be7040.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 188
  2⤵
  - Program crash
  PID:960