db2a68fc0681daf4d2963bbbe42420483bf6126eddd6bb56322c3b7a0e07b406

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 00:16

Target

db2a68fc0681daf4d2963bbbe42420483bf6126eddd6bb56322c3b7a0e07b406.exe
Size

164KB
MD5

52e796234d49a50d089251b35f171d89
SHA1

3727b98c0b27f13c297f7fe3ec40553348509eaf
SHA256

db2a68fc0681daf4d2963bbbe42420483bf6126eddd6bb56322c3b7a0e07b406
SHA512

79b2e704e15750786b787a7e0baf1ed395483a9cb43ee6b360d8f854d1a4371131771cecfe24628f2f60ae166e9ca1bd125b3fbb95e46c20b1e8a6d6855520c7
SSDEEP

3072:SGzsrBzoe5g+GwJs8K9YUoIrJaRuSZ/JlQPj/PYv2wM0B2vmkHgHAGFAhl4oQZiy:SGwrcP9YErMRuSZ/JlQLHYv2PvzGAMA

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

540 1416 WerFault.exe db2a68fc0681daf4d2963bbbe42420483bf6126eddd6bb56322c3b7a0e07b406.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

db2a68fc0681daf4d2963bbbe42420483bf6126eddd6bb56322c3b7a0e07b406.exe

pid process

1416 db2a68fc0681daf4d2963bbbe42420483bf6126eddd6bb56322c3b7a0e07b406.exe

pid	pid_target	process	target process
540	1416	WerFault.exe	db2a68fc0681daf4d2963bbbe42420483bf6126eddd6bb56322c3b7a0e07b406.exe

pid	process
1416	db2a68fc0681daf4d2963bbbe42420483bf6126eddd6bb56322c3b7a0e07b406.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

db2a68fc0681daf4d2963bbbe42420483bf6126eddd6bb56322c3b7a0e07b406.exe

description	pid	process	target process
PID 1416 wrote to memory of 540	1416	db2a68fc0681daf4d2963bbbe42420483bf6126eddd6bb56322c3b7a0e07b406.exe	WerFault.exe
PID 1416 wrote to memory of 540	1416	db2a68fc0681daf4d2963bbbe42420483bf6126eddd6bb56322c3b7a0e07b406.exe	WerFault.exe
PID 1416 wrote to memory of 540	1416	db2a68fc0681daf4d2963bbbe42420483bf6126eddd6bb56322c3b7a0e07b406.exe	WerFault.exe
PID 1416 wrote to memory of 540	1416	db2a68fc0681daf4d2963bbbe42420483bf6126eddd6bb56322c3b7a0e07b406.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\db2a68fc0681daf4d2963bbbe42420483bf6126eddd6bb56322c3b7a0e07b406.exe
"C:\Users\Admin\AppData\Local\Temp\db2a68fc0681daf4d2963bbbe42420483bf6126eddd6bb56322c3b7a0e07b406.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 188
  2⤵
  - Program crash
  PID:540

memory/540-56-0x0000000000000000-mapping.dmp

Download
memory/1416-57-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download