b61476aa088d1115380609088a716b16fe72b33c0376bcef9541b77f8a0da72f

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 19:01

Target

b61476aa088d1115380609088a716b16fe72b33c0376bcef9541b77f8a0da72f.exe
Size

428KB
MD5

4640859498f5b1a227c408be37b91e23
SHA1

7da5607475415e5e147f26fcf2df63df8fdc8ca5
SHA256

b61476aa088d1115380609088a716b16fe72b33c0376bcef9541b77f8a0da72f
SHA512

ca2f0928c4c048a48f015fb57a2650eb3d1ef2c6ed23debe28823efca5d67465344413b464935177ed8943a90b9e5473ffe822d4fe716eb6fd8b0331ea6a195e
SSDEEP

12288:RKZI/BcWRgqR1Wg10YMtXDZa7dlFsnOKTv:RKZinTWg10YMVw7d/sOKTv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1664	1660	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1660	b61476aa088d1115380609088a716b16fe72b33c0376bcef9541b77f8a0da72f.exe
1660	b61476aa088d1115380609088a716b16fe72b33c0376bcef9541b77f8a0da72f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1664	1660	b61476aa088d1115380609088a716b16fe72b33c0376bcef9541b77f8a0da72f.exe	28
PID 1660 wrote to memory of 1664	1660	b61476aa088d1115380609088a716b16fe72b33c0376bcef9541b77f8a0da72f.exe	28
PID 1660 wrote to memory of 1664	1660	b61476aa088d1115380609088a716b16fe72b33c0376bcef9541b77f8a0da72f.exe	28
PID 1660 wrote to memory of 1664	1660	b61476aa088d1115380609088a716b16fe72b33c0376bcef9541b77f8a0da72f.exe	28

C:\Users\Admin\AppData\Local\Temp\b61476aa088d1115380609088a716b16fe72b33c0376bcef9541b77f8a0da72f.exe
"C:\Users\Admin\AppData\Local\Temp\b61476aa088d1115380609088a716b16fe72b33c0376bcef9541b77f8a0da72f.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 224
  2⤵
  - Program crash
  PID:1664