9fa6197ee4a6ab6d481497e1d5b0f11fbf5ef93f5cff4cfe0aee7f05ca476432

Analysis

max time kernel
2s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 19:53

Target

9fa6197ee4a6ab6d481497e1d5b0f11fbf5ef93f5cff4cfe0aee7f05ca476432.exe
Size

160KB
MD5

097161fd45786a4d5623a0ffd9c94f50
SHA1

5518d793bbffa2a1f99abe6c6280237611ff3372
SHA256

9fa6197ee4a6ab6d481497e1d5b0f11fbf5ef93f5cff4cfe0aee7f05ca476432
SHA512

17bdc2435e80db07aa59e760c190d9c7722583da240cf7559b0436f78d305beeef9eba75c7f77be143494d01c991a39290e85c1e246bf9f5fd5317b382876066
SSDEEP

3072:BhXFxJptfKqOdBsebgeDyJiqmdoTtawZPotUPvPDspYxjatL0JiTeDXokR49M6ec:vXFDptfKRLsebgeDyJtmdo7PIWDspYJ+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
280	952	WerFault.exe	17

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
952	9fa6197ee4a6ab6d481497e1d5b0f11fbf5ef93f5cff4cfe0aee7f05ca476432.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 280	952	9fa6197ee4a6ab6d481497e1d5b0f11fbf5ef93f5cff4cfe0aee7f05ca476432.exe	28
PID 952 wrote to memory of 280	952	9fa6197ee4a6ab6d481497e1d5b0f11fbf5ef93f5cff4cfe0aee7f05ca476432.exe	28
PID 952 wrote to memory of 280	952	9fa6197ee4a6ab6d481497e1d5b0f11fbf5ef93f5cff4cfe0aee7f05ca476432.exe	28
PID 952 wrote to memory of 280	952	9fa6197ee4a6ab6d481497e1d5b0f11fbf5ef93f5cff4cfe0aee7f05ca476432.exe	28

C:\Users\Admin\AppData\Local\Temp\9fa6197ee4a6ab6d481497e1d5b0f11fbf5ef93f5cff4cfe0aee7f05ca476432.exe
"C:\Users\Admin\AppData\Local\Temp\9fa6197ee4a6ab6d481497e1d5b0f11fbf5ef93f5cff4cfe0aee7f05ca476432.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 188
  2⤵
  - Program crash
  PID:280