d2ca143ac67bc2ee2ff9aa9093280a428ebf73b323ee9d955e4d0b87b40a5eb0

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 16:59

Target

d2ca143ac67bc2ee2ff9aa9093280a428ebf73b323ee9d955e4d0b87b40a5eb0.exe
Size

96KB
MD5

1ef56230a2ffcf7d40144ab78bb458b9
SHA1

a6033e89b90b196d67d19535269cefa678dccf01
SHA256

d2ca143ac67bc2ee2ff9aa9093280a428ebf73b323ee9d955e4d0b87b40a5eb0
SHA512

a96ab05fa899ff933fc43ca56f0b7579afcadecf2a9b7dd0b22836fd5ffd4fd576501bf4b7c28c44a0d9bafde0a8f2e60b59206267987ae1a5631ba1d00e6407
SSDEEP

1536:BkhBHjf6cOahYBkGulSc16l6u+NMMl/KlYv1T4hThFfNIjnZKd:45hLlu88FFfCn8d

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1332	1760	WerFault.exe	26

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1760	d2ca143ac67bc2ee2ff9aa9093280a428ebf73b323ee9d955e4d0b87b40a5eb0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1332	1760	d2ca143ac67bc2ee2ff9aa9093280a428ebf73b323ee9d955e4d0b87b40a5eb0.exe	27
PID 1760 wrote to memory of 1332	1760	d2ca143ac67bc2ee2ff9aa9093280a428ebf73b323ee9d955e4d0b87b40a5eb0.exe	27
PID 1760 wrote to memory of 1332	1760	d2ca143ac67bc2ee2ff9aa9093280a428ebf73b323ee9d955e4d0b87b40a5eb0.exe	27
PID 1760 wrote to memory of 1332	1760	d2ca143ac67bc2ee2ff9aa9093280a428ebf73b323ee9d955e4d0b87b40a5eb0.exe	27

C:\Users\Admin\AppData\Local\Temp\d2ca143ac67bc2ee2ff9aa9093280a428ebf73b323ee9d955e4d0b87b40a5eb0.exe
"C:\Users\Admin\AppData\Local\Temp\d2ca143ac67bc2ee2ff9aa9093280a428ebf73b323ee9d955e4d0b87b40a5eb0.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 188
  2⤵
  - Program crash
  PID:1332

memory/1760-56-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download