b0971c4d927221bd55f86a0d022e55aff388850c70d9a63e100cb37f212735e2

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 17:15

Target

b0971c4d927221bd55f86a0d022e55aff388850c70d9a63e100cb37f212735e2.exe
Size

168KB
MD5

d3f389267fd7359d82421b075af04e56
SHA1

2a7a9c35204425acb33b82adfb22f94e901a8a00
SHA256

b0971c4d927221bd55f86a0d022e55aff388850c70d9a63e100cb37f212735e2
SHA512

c1e32b1acc550136a8233c17774ed26c8e6b4020165aab8c0187fc4bb274724db5342639d5fe0308e49379fe79065a9340a3806773a427365680063585879995
SSDEEP

3072:iLQaAceKnRshndKAH4r3h2Wm3BWjqLSmP1Vwpn24tU4XjCwH:iLQonRshdO3oGmnCpn2o

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
880	1668	WerFault.exe	26

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1668	b0971c4d927221bd55f86a0d022e55aff388850c70d9a63e100cb37f212735e2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 880	1668	b0971c4d927221bd55f86a0d022e55aff388850c70d9a63e100cb37f212735e2.exe	27
PID 1668 wrote to memory of 880	1668	b0971c4d927221bd55f86a0d022e55aff388850c70d9a63e100cb37f212735e2.exe	27
PID 1668 wrote to memory of 880	1668	b0971c4d927221bd55f86a0d022e55aff388850c70d9a63e100cb37f212735e2.exe	27
PID 1668 wrote to memory of 880	1668	b0971c4d927221bd55f86a0d022e55aff388850c70d9a63e100cb37f212735e2.exe	27

C:\Users\Admin\AppData\Local\Temp\b0971c4d927221bd55f86a0d022e55aff388850c70d9a63e100cb37f212735e2.exe
"C:\Users\Admin\AppData\Local\Temp\b0971c4d927221bd55f86a0d022e55aff388850c70d9a63e100cb37f212735e2.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 196
  2⤵
  - Program crash
  PID:880

memory/1668-56-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1668-58-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download