8fdc446fc9198a68c1b65493a2a5018fdcc3e2a834d360a65923a6d0cce82996

Analysis

max time kernel
34s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 06:41

Target

8fdc446fc9198a68c1b65493a2a5018fdcc3e2a834d360a65923a6d0cce82996.exe
Size

134KB
MD5

5ac19ccff234e1eab0c9e9ce3f71c43e
SHA1

3d281a2d0ac77ac6077bf45b8e27c1aaa8dc907e
SHA256

8fdc446fc9198a68c1b65493a2a5018fdcc3e2a834d360a65923a6d0cce82996
SHA512

97c50b5d2795f9659a4c6059025e1c1a266de03266df15293cd6926699ad514e8248d81502b6542f3563cba945593637931168b36d2a976f040cf0bfdad1313a
SSDEEP

1536:3XuhdHhziFB3Z8Xvhfv/IMXPDZPRWWrIY75HtbudMO2T7ohbQ/dY6+wdPoqerDJ:HkHhOFBprcdsWd75NKrpQlJ+eoqeh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1064	1384	WerFault.exe	26

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1384	8fdc446fc9198a68c1b65493a2a5018fdcc3e2a834d360a65923a6d0cce82996.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 1064	1384	8fdc446fc9198a68c1b65493a2a5018fdcc3e2a834d360a65923a6d0cce82996.exe	27
PID 1384 wrote to memory of 1064	1384	8fdc446fc9198a68c1b65493a2a5018fdcc3e2a834d360a65923a6d0cce82996.exe	27
PID 1384 wrote to memory of 1064	1384	8fdc446fc9198a68c1b65493a2a5018fdcc3e2a834d360a65923a6d0cce82996.exe	27
PID 1384 wrote to memory of 1064	1384	8fdc446fc9198a68c1b65493a2a5018fdcc3e2a834d360a65923a6d0cce82996.exe	27

C:\Users\Admin\AppData\Local\Temp\8fdc446fc9198a68c1b65493a2a5018fdcc3e2a834d360a65923a6d0cce82996.exe
"C:\Users\Admin\AppData\Local\Temp\8fdc446fc9198a68c1b65493a2a5018fdcc3e2a834d360a65923a6d0cce82996.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 196
  2⤵
  - Program crash
  PID:1064