d2038c81cad48cdb36307d56d9962e9ed31ca6b0081ca0144bb9a081d195f094

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 18:50

Target

d2038c81cad48cdb36307d56d9962e9ed31ca6b0081ca0144bb9a081d195f094.exe
Size

688KB
MD5

9e0a98915fbf950eb3dbe150fc714359
SHA1

9a4d488b3af31cbcd23d31d24ddc964df470b586
SHA256

d2038c81cad48cdb36307d56d9962e9ed31ca6b0081ca0144bb9a081d195f094
SHA512

a4872de66d0bd3feeb61daf2e426b3b34aae076affb6f68bb168e6b45591513481df48c88b7e65a3bcf5bb4a128d3b9ccefa88ac6840b6c12df80cd56a676759
SSDEEP

6144:WYvQ3CJ0eel1vWjLu7ioQxI3F6GlSkwlS9z6enixH53dybisnrQ2qLfPoYt:ICJ0eU9oLu7ioQxIX4S9+fnAisnrMoU

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

988 1696 WerFault.exe d2038c81cad48cdb36307d56d9962e9ed31ca6b0081ca0144bb9a081d195f094.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

d2038c81cad48cdb36307d56d9962e9ed31ca6b0081ca0144bb9a081d195f094.exe

pid process

1696 d2038c81cad48cdb36307d56d9962e9ed31ca6b0081ca0144bb9a081d195f094.exe

pid	pid_target	process	target process
988	1696	WerFault.exe	d2038c81cad48cdb36307d56d9962e9ed31ca6b0081ca0144bb9a081d195f094.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

d2038c81cad48cdb36307d56d9962e9ed31ca6b0081ca0144bb9a081d195f094.exe

pid	process
1696	d2038c81cad48cdb36307d56d9962e9ed31ca6b0081ca0144bb9a081d195f094.exe
1696	d2038c81cad48cdb36307d56d9962e9ed31ca6b0081ca0144bb9a081d195f094.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d2038c81cad48cdb36307d56d9962e9ed31ca6b0081ca0144bb9a081d195f094.exe

description	pid	process	target process
PID 1696 wrote to memory of 988	1696	d2038c81cad48cdb36307d56d9962e9ed31ca6b0081ca0144bb9a081d195f094.exe	WerFault.exe
PID 1696 wrote to memory of 988	1696	d2038c81cad48cdb36307d56d9962e9ed31ca6b0081ca0144bb9a081d195f094.exe	WerFault.exe
PID 1696 wrote to memory of 988	1696	d2038c81cad48cdb36307d56d9962e9ed31ca6b0081ca0144bb9a081d195f094.exe	WerFault.exe
PID 1696 wrote to memory of 988	1696	d2038c81cad48cdb36307d56d9962e9ed31ca6b0081ca0144bb9a081d195f094.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 264
2⤵
- Program crash
PID:988

memory/988-55-0x0000000000000000-mapping.dmp

Download
memory/1696-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1696-56-0x00000000001E0000-0x00000000001E4000-memory.dmp

Filesize
16KB

Download