bd79e97244498fa523cea18b1afaec9ee6e87b7ce49d9dd26d324f008d2fde6b

Analysis

max time kernel
159s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 19:31

Target

bd79e97244498fa523cea18b1afaec9ee6e87b7ce49d9dd26d324f008d2fde6b.exe
Size

152KB
MD5

2ef637260cb985f606ca84777896cba0
SHA1

84ccecbb71ef4dd028d46990363a2ae29adedbbd
SHA256

bd79e97244498fa523cea18b1afaec9ee6e87b7ce49d9dd26d324f008d2fde6b
SHA512

a166a04fe05af164145f8ff0ff433d5723fdf46c0a31af82322dae2ace40e0b0d2b6f20e9870dedd53fc26c247403c16f9884e903ced910fd0f4f05fbae77e3c
SSDEEP

1536:c1DMz1DQvXLq6t7awFONecenlLnQHIG5R9c73P600t:9eGw9A0rC00t

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
644	3304	WerFault.exe	bd79e97244498fa523cea18b1afaec9ee6e87b7ce49d9dd26d324f008d2fde6b.exe
1432	3304	WerFault.exe	bd79e97244498fa523cea18b1afaec9ee6e87b7ce49d9dd26d324f008d2fde6b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

bd79e97244498fa523cea18b1afaec9ee6e87b7ce49d9dd26d324f008d2fde6b.exe

pid process

3304 bd79e97244498fa523cea18b1afaec9ee6e87b7ce49d9dd26d324f008d2fde6b.exe

pid	process
3304	bd79e97244498fa523cea18b1afaec9ee6e87b7ce49d9dd26d324f008d2fde6b.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

bd79e97244498fa523cea18b1afaec9ee6e87b7ce49d9dd26d324f008d2fde6b.exe

description	pid	process	target process
PID 3304 wrote to memory of 644	3304	bd79e97244498fa523cea18b1afaec9ee6e87b7ce49d9dd26d324f008d2fde6b.exe	WerFault.exe
PID 3304 wrote to memory of 644	3304	bd79e97244498fa523cea18b1afaec9ee6e87b7ce49d9dd26d324f008d2fde6b.exe	WerFault.exe
PID 3304 wrote to memory of 644	3304	bd79e97244498fa523cea18b1afaec9ee6e87b7ce49d9dd26d324f008d2fde6b.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 464
2⤵
- Program crash
PID:644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 464
2⤵
- Program crash
PID:1432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3304 -ip 3304
1⤵
PID:3212