c64bab69557d30b346a4d8c5a7f74c1a5c5a486996fa3ffd260dc96b731e228e

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 05:32

Target

c64bab69557d30b346a4d8c5a7f74c1a5c5a486996fa3ffd260dc96b731e228e.exe
Size

318KB
MD5

05b775810a77a06fa4f07e5b90e0a3db
SHA1

fd0464b57a8c92a03dfa1edb5a2044e2de9b8804
SHA256

c64bab69557d30b346a4d8c5a7f74c1a5c5a486996fa3ffd260dc96b731e228e
SHA512

c9af46f64782d68f3588be245fb883a31f75561eb851f56f68ad6d04a96ebf3871fb0ad937f79d3906a35ed63878473b2e2628a3b7a10e4f2e7d7bd70d7c4afe
SSDEEP

6144:SbtRwVGdTt8quIfu0mKt9sWa2qqoz+4mkm1TfMkbC:ydB8cfu0qWa2kz+3jF5bC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1172	1928	WerFault.exe	25

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1928	c64bab69557d30b346a4d8c5a7f74c1a5c5a486996fa3ffd260dc96b731e228e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1708	1928	c64bab69557d30b346a4d8c5a7f74c1a5c5a486996fa3ffd260dc96b731e228e.exe	26
PID 1928 wrote to memory of 1708	1928	c64bab69557d30b346a4d8c5a7f74c1a5c5a486996fa3ffd260dc96b731e228e.exe	26
PID 1928 wrote to memory of 1708	1928	c64bab69557d30b346a4d8c5a7f74c1a5c5a486996fa3ffd260dc96b731e228e.exe	26
PID 1928 wrote to memory of 1708	1928	c64bab69557d30b346a4d8c5a7f74c1a5c5a486996fa3ffd260dc96b731e228e.exe	26
PID 1928 wrote to memory of 1172	1928	c64bab69557d30b346a4d8c5a7f74c1a5c5a486996fa3ffd260dc96b731e228e.exe	27
PID 1928 wrote to memory of 1172	1928	c64bab69557d30b346a4d8c5a7f74c1a5c5a486996fa3ffd260dc96b731e228e.exe	27
PID 1928 wrote to memory of 1172	1928	c64bab69557d30b346a4d8c5a7f74c1a5c5a486996fa3ffd260dc96b731e228e.exe	27
PID 1928 wrote to memory of 1172	1928	c64bab69557d30b346a4d8c5a7f74c1a5c5a486996fa3ffd260dc96b731e228e.exe	27

C:\Users\Admin\AppData\Local\Temp\c64bab69557d30b346a4d8c5a7f74c1a5c5a486996fa3ffd260dc96b731e228e.exe
"C:\Users\Admin\AppData\Local\Temp\c64bab69557d30b346a4d8c5a7f74c1a5c5a486996fa3ffd260dc96b731e228e.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Users\Admin\AppData\Local\Temp\c64bab69557d30b346a4d8c5a7f74c1a5c5a486996fa3ffd260dc96b731e228e.exe
  "C:\Users\Admin\AppData\Local\Temp\c64bab69557d30b346a4d8c5a7f74c1a5c5a486996fa3ffd260dc96b731e228e.exe"
  2⤵
  PID:1708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 196
  2⤵
  - Program crash
  PID:1172