56c509064d17dfd36d69836ce2323d70e7caa4bc3e00b910339cbfdcad638826

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 17:13

Target

56c509064d17dfd36d69836ce2323d70e7caa4bc3e00b910339cbfdcad638826.exe
Size

168KB
MD5

112cc78b4ad17130d43300b2b81376de
SHA1

7260013ec5963fe163b807c7ed2be2fbb1df34e0
SHA256

56c509064d17dfd36d69836ce2323d70e7caa4bc3e00b910339cbfdcad638826
SHA512

480aaa8748a49364a746da57870b24ffb41f4666af4afc7f8124eec697a98affb2369da853f494338aed1b16c0f50c182f3743d6698bddfe2804269b94b57bd7
SSDEEP

3072:QhGs8TBY7SIsyeTlo/11hJl2czGRqxZdxxW9035:QhGDTBYi/lS1NJG6/x5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1968	1960	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1960	56c509064d17dfd36d69836ce2323d70e7caa4bc3e00b910339cbfdcad638826.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1968	1960	56c509064d17dfd36d69836ce2323d70e7caa4bc3e00b910339cbfdcad638826.exe	28
PID 1960 wrote to memory of 1968	1960	56c509064d17dfd36d69836ce2323d70e7caa4bc3e00b910339cbfdcad638826.exe	28
PID 1960 wrote to memory of 1968	1960	56c509064d17dfd36d69836ce2323d70e7caa4bc3e00b910339cbfdcad638826.exe	28
PID 1960 wrote to memory of 1968	1960	56c509064d17dfd36d69836ce2323d70e7caa4bc3e00b910339cbfdcad638826.exe	28

C:\Users\Admin\AppData\Local\Temp\56c509064d17dfd36d69836ce2323d70e7caa4bc3e00b910339cbfdcad638826.exe
"C:\Users\Admin\AppData\Local\Temp\56c509064d17dfd36d69836ce2323d70e7caa4bc3e00b910339cbfdcad638826.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 188
  2⤵
  - Program crash
  PID:1968