588bad774c604cdb55ab60840f6b6a3dfc65722ed69307d9f8a55af2743645ce

Analysis

max time kernel
19s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 03:23

Target

588bad774c604cdb55ab60840f6b6a3dfc65722ed69307d9f8a55af2743645ce.exe
Size

36KB
MD5

859cdf92a3d2518039bed78758891d99
SHA1

d4fcf0764789ff4a0e3a5a36749bc982acc096ac
SHA256

588bad774c604cdb55ab60840f6b6a3dfc65722ed69307d9f8a55af2743645ce
SHA512

39b7251b627e9496ba682ff208a15d87f74f7d857e8b24316e60ff473adbe16e0912e217a7a656a10d3dc0c387e5f97c19243e95c9bfd5ba73b47b724ab4e46b
SSDEEP

384:YrcbDJYRQ1eLAciFGvSaKc0oLRmqoWCe+5wcoomd3WOpHwzQOL+ybVcRPLM2:YraiRPvKGpKcDLwqo2Cwcz0K86c5Q2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1444	1640	WerFault.exe	16

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1640	588bad774c604cdb55ab60840f6b6a3dfc65722ed69307d9f8a55af2743645ce.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1444	1640	588bad774c604cdb55ab60840f6b6a3dfc65722ed69307d9f8a55af2743645ce.exe	27
PID 1640 wrote to memory of 1444	1640	588bad774c604cdb55ab60840f6b6a3dfc65722ed69307d9f8a55af2743645ce.exe	27
PID 1640 wrote to memory of 1444	1640	588bad774c604cdb55ab60840f6b6a3dfc65722ed69307d9f8a55af2743645ce.exe	27
PID 1640 wrote to memory of 1444	1640	588bad774c604cdb55ab60840f6b6a3dfc65722ed69307d9f8a55af2743645ce.exe	27

C:\Users\Admin\AppData\Local\Temp\588bad774c604cdb55ab60840f6b6a3dfc65722ed69307d9f8a55af2743645ce.exe
"C:\Users\Admin\AppData\Local\Temp\588bad774c604cdb55ab60840f6b6a3dfc65722ed69307d9f8a55af2743645ce.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 384
  2⤵
  - Program crash
  PID:1444

memory/1444-58-0x0000000000000000-mapping.dmp

Download
memory/1640-56-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1640-57-0x0000000003180000-0x00000000041E2000-memory.dmp

Filesize
16.4MB

Download