4fff3587915bd7525aaba1959cb9cd85bb99cb9fb2d211662d55b7eb133a1008

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 01:39

Target

4fff3587915bd7525aaba1959cb9cd85bb99cb9fb2d211662d55b7eb133a1008.exe
Size

580KB
MD5

add84b66f6a6141777496db29535e8b1
SHA1

9bc94956956b1f2276dcd115756fa25340eba52b
SHA256

4fff3587915bd7525aaba1959cb9cd85bb99cb9fb2d211662d55b7eb133a1008
SHA512

393f8e62e640b3a603489c12973219776b94d42e8aa5fc4fd2949f90b6f04e534daccd60107c7e54cc547d9ba7000aef8a35f348fb6d34e7da516658218e3b2c
SSDEEP

6144:wYvQ3CJ0eel1vWjLu7ioQxI3F6GlSa6fVTWQvc19jlns5GDevfPoYt:GCJ0eU9oLu7ioQxImfhW4C9jlnyce/oU

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1900 1960 WerFault.exe 4fff3587915bd7525aaba1959cb9cd85bb99cb9fb2d211662d55b7eb133a1008.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

4fff3587915bd7525aaba1959cb9cd85bb99cb9fb2d211662d55b7eb133a1008.exe

pid process

1960 4fff3587915bd7525aaba1959cb9cd85bb99cb9fb2d211662d55b7eb133a1008.exe

pid	pid_target	process	target process
1900	1960	WerFault.exe	4fff3587915bd7525aaba1959cb9cd85bb99cb9fb2d211662d55b7eb133a1008.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

4fff3587915bd7525aaba1959cb9cd85bb99cb9fb2d211662d55b7eb133a1008.exe

pid	process
1960	4fff3587915bd7525aaba1959cb9cd85bb99cb9fb2d211662d55b7eb133a1008.exe
1960	4fff3587915bd7525aaba1959cb9cd85bb99cb9fb2d211662d55b7eb133a1008.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4fff3587915bd7525aaba1959cb9cd85bb99cb9fb2d211662d55b7eb133a1008.exe

description	pid	process	target process
PID 1960 wrote to memory of 1900	1960	4fff3587915bd7525aaba1959cb9cd85bb99cb9fb2d211662d55b7eb133a1008.exe	WerFault.exe
PID 1960 wrote to memory of 1900	1960	4fff3587915bd7525aaba1959cb9cd85bb99cb9fb2d211662d55b7eb133a1008.exe	WerFault.exe
PID 1960 wrote to memory of 1900	1960	4fff3587915bd7525aaba1959cb9cd85bb99cb9fb2d211662d55b7eb133a1008.exe	WerFault.exe
PID 1960 wrote to memory of 1900	1960	4fff3587915bd7525aaba1959cb9cd85bb99cb9fb2d211662d55b7eb133a1008.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 264
2⤵
- Program crash
PID:1900

memory/1900-56-0x0000000000000000-mapping.dmp

Download
memory/1960-54-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download
memory/1960-55-0x00000000002C0000-0x00000000002C4000-memory.dmp

Filesize
16KB

Download