b25d31e2352bb822fa9dd4e418a71bf8495e67f87d4cba0aa96d96de55da35f3

Analysis

max time kernel
36s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 12:32

Target

b25d31e2352bb822fa9dd4e418a71bf8495e67f87d4cba0aa96d96de55da35f3.exe
Size

6.3MB
MD5

4e1cf9e33d17ce80a8b496ad544869b4
SHA1

4d389c23fab82d9c998894bcf13a0269ff6f1d56
SHA256

b25d31e2352bb822fa9dd4e418a71bf8495e67f87d4cba0aa96d96de55da35f3
SHA512

f8b48e8f25d3d9b9d9384510cf6082bb63bb35375acb59259c05a4987db4ed10e83aa639c5b775ae7b78521bc070df8ad61cd0ff453aac0bfcdede9547f65334
SSDEEP

98304:+rwvCUyC2xVF/+6QiIVwsHBboPUDso7cp2sCyK5rdFGAsswatge+:qwvCvL+ziIVwsHBAb2sCyKJdF3RBge+

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

b25d31e2352bb822fa9dd4e418a71bf8495e67f87d4cba0aa96d96de55da35f3.exe

pid process

1980 b25d31e2352bb822fa9dd4e418a71bf8495e67f87d4cba0aa96d96de55da35f3.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1796 1980 WerFault.exe b25d31e2352bb822fa9dd4e418a71bf8495e67f87d4cba0aa96d96de55da35f3.exe

pid	pid_target	process	target process
1796	1980	WerFault.exe	b25d31e2352bb822fa9dd4e418a71bf8495e67f87d4cba0aa96d96de55da35f3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

b25d31e2352bb822fa9dd4e418a71bf8495e67f87d4cba0aa96d96de55da35f3.exe

pid	process
1980	b25d31e2352bb822fa9dd4e418a71bf8495e67f87d4cba0aa96d96de55da35f3.exe
1980	b25d31e2352bb822fa9dd4e418a71bf8495e67f87d4cba0aa96d96de55da35f3.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b25d31e2352bb822fa9dd4e418a71bf8495e67f87d4cba0aa96d96de55da35f3.exe

description	pid	process	target process
PID 1980 wrote to memory of 1796	1980	b25d31e2352bb822fa9dd4e418a71bf8495e67f87d4cba0aa96d96de55da35f3.exe	WerFault.exe
PID 1980 wrote to memory of 1796	1980	b25d31e2352bb822fa9dd4e418a71bf8495e67f87d4cba0aa96d96de55da35f3.exe	WerFault.exe
PID 1980 wrote to memory of 1796	1980	b25d31e2352bb822fa9dd4e418a71bf8495e67f87d4cba0aa96d96de55da35f3.exe	WerFault.exe
PID 1980 wrote to memory of 1796	1980	b25d31e2352bb822fa9dd4e418a71bf8495e67f87d4cba0aa96d96de55da35f3.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 560
2⤵
- Program crash
PID:1796

memory/1796-62-0x0000000000000000-mapping.dmp

Download
memory/1980-54-0x00000000028E0000-0x0000000002B2D000-memory.dmp

Filesize
2.3MB

Download
memory/1980-55-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1980-56-0x00000000028E0000-0x0000000002B2D000-memory.dmp

Filesize
2.3MB

Download
memory/1980-57-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/1980-58-0x00000000028E0000-0x0000000002B2D000-memory.dmp

Filesize
2.3MB

Download
memory/1980-59-0x00000000028E0000-0x0000000002B2D000-memory.dmp

Filesize
2.3MB

Download
memory/1980-61-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/1980-63-0x00000000028E0000-0x0000000002B2D000-memory.dmp

Filesize
2.3MB

Download