a97b85ef0e4636dd47d2264cd82ed18aad5c038641e05373bbe5f5f79107de51

Analysis

max time kernel
230s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 11:37

Target

a97b85ef0e4636dd47d2264cd82ed18aad5c038641e05373bbe5f5f79107de51.exe
Size

52KB
MD5

07588958bde362f00bdc5cae370c4a78
SHA1

4f76b7e575a0d421110ff72d8fc553ca76ed83d7
SHA256

a97b85ef0e4636dd47d2264cd82ed18aad5c038641e05373bbe5f5f79107de51
SHA512

2a05af06027ae18758f098d27e35dcd25397358dfe9699168cf96a930d322ec11828596c54c7033fd63431a6db5ec71f28061fb3dad615eeddd31cac3f4ecf77
SSDEEP

768:/r5bpR5N2C7SkiR8LCe5YH9ckaat5DsiTQxubxG/vTAlo1aLSFWcbkF:lbp3iH2myiUWGn0OFWcbO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1028	896	WerFault.exe	20

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
896	a97b85ef0e4636dd47d2264cd82ed18aad5c038641e05373bbe5f5f79107de51.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 1028	896	a97b85ef0e4636dd47d2264cd82ed18aad5c038641e05373bbe5f5f79107de51.exe	28
PID 896 wrote to memory of 1028	896	a97b85ef0e4636dd47d2264cd82ed18aad5c038641e05373bbe5f5f79107de51.exe	28
PID 896 wrote to memory of 1028	896	a97b85ef0e4636dd47d2264cd82ed18aad5c038641e05373bbe5f5f79107de51.exe	28
PID 896 wrote to memory of 1028	896	a97b85ef0e4636dd47d2264cd82ed18aad5c038641e05373bbe5f5f79107de51.exe	28

C:\Users\Admin\AppData\Local\Temp\a97b85ef0e4636dd47d2264cd82ed18aad5c038641e05373bbe5f5f79107de51.exe
"C:\Users\Admin\AppData\Local\Temp\a97b85ef0e4636dd47d2264cd82ed18aad5c038641e05373bbe5f5f79107de51.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 896 -s 188
  2⤵
  - Program crash
  PID:1028