92ecf95133f8de6d7de8b5e404f59d07fbafe21633efa08ae0e86b7669018b1f

Analysis

max time kernel
41s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 23:58

Target

92ecf95133f8de6d7de8b5e404f59d07fbafe21633efa08ae0e86b7669018b1f.exe
Size

108KB
MD5

1426c390663857476d55096a4ca5ae74
SHA1

f3f25638d5dc3a797b251cc0e54016eb8e6e5497
SHA256

92ecf95133f8de6d7de8b5e404f59d07fbafe21633efa08ae0e86b7669018b1f
SHA512

c1d758d889e423861cd5c4ccaa08e8c50044c3c350e3b0874a1f256fd275e72b5399492e3516bbbb427e7388e7960c57a585d2911317e7c1592d8dd0004b392b
SSDEEP

1536:E0hd5vfeWVL9nyz1ceWVLv0ecBzH/8/FgWi8Bh7:NmWVL6WVLv0ygWi8Bh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1248	632	WerFault.exe	20

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
632	92ecf95133f8de6d7de8b5e404f59d07fbafe21633efa08ae0e86b7669018b1f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 1248	632	92ecf95133f8de6d7de8b5e404f59d07fbafe21633efa08ae0e86b7669018b1f.exe	28
PID 632 wrote to memory of 1248	632	92ecf95133f8de6d7de8b5e404f59d07fbafe21633efa08ae0e86b7669018b1f.exe	28
PID 632 wrote to memory of 1248	632	92ecf95133f8de6d7de8b5e404f59d07fbafe21633efa08ae0e86b7669018b1f.exe	28
PID 632 wrote to memory of 1248	632	92ecf95133f8de6d7de8b5e404f59d07fbafe21633efa08ae0e86b7669018b1f.exe	28

C:\Users\Admin\AppData\Local\Temp\92ecf95133f8de6d7de8b5e404f59d07fbafe21633efa08ae0e86b7669018b1f.exe
"C:\Users\Admin\AppData\Local\Temp\92ecf95133f8de6d7de8b5e404f59d07fbafe21633efa08ae0e86b7669018b1f.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 188
  2⤵
  - Program crash
  PID:1248