ab98c33ec320148b3f749bb7c8ecd94ee60667c145aaa343c23a39fb6cdde0b6

Analysis

max time kernel
242s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 17:17

Target

ab98c33ec320148b3f749bb7c8ecd94ee60667c145aaa343c23a39fb6cdde0b6.exe
Size

56KB
MD5

8eb0af5bb58a200b634088fd4e0d0ea2
SHA1

664a337c0d7f42a5fbb8619d6996542f7e836ffe
SHA256

ab98c33ec320148b3f749bb7c8ecd94ee60667c145aaa343c23a39fb6cdde0b6
SHA512

d6f76849ab2f1ff6c516bab3a1143752fb952bcf35707ab31a8cd66046eb0cebbbb903b29aa52d219c074c25cff0c8dc6b77811ad4bc6446b263bc5b862aacd0
SSDEEP

768:17+SRrzWFDo/p8bbOAcDCudBSwFOXoQEmUMOX4J:nRK90CudBSWtc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1880	556	WerFault.exe	18

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
556	ab98c33ec320148b3f749bb7c8ecd94ee60667c145aaa343c23a39fb6cdde0b6.exe
556	ab98c33ec320148b3f749bb7c8ecd94ee60667c145aaa343c23a39fb6cdde0b6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 1880	556	ab98c33ec320148b3f749bb7c8ecd94ee60667c145aaa343c23a39fb6cdde0b6.exe	28
PID 556 wrote to memory of 1880	556	ab98c33ec320148b3f749bb7c8ecd94ee60667c145aaa343c23a39fb6cdde0b6.exe	28
PID 556 wrote to memory of 1880	556	ab98c33ec320148b3f749bb7c8ecd94ee60667c145aaa343c23a39fb6cdde0b6.exe	28
PID 556 wrote to memory of 1880	556	ab98c33ec320148b3f749bb7c8ecd94ee60667c145aaa343c23a39fb6cdde0b6.exe	28

C:\Users\Admin\AppData\Local\Temp\ab98c33ec320148b3f749bb7c8ecd94ee60667c145aaa343c23a39fb6cdde0b6.exe
"C:\Users\Admin\AppData\Local\Temp\ab98c33ec320148b3f749bb7c8ecd94ee60667c145aaa343c23a39fb6cdde0b6.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 228
  2⤵
  - Program crash
  PID:1880