d18d71389ca1896f5702bbef381508d9eb8e0789f5dc655d9468bc6b84368c01

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 22:12

Target

d18d71389ca1896f5702bbef381508d9eb8e0789f5dc655d9468bc6b84368c01.exe
Size

124KB
MD5

fc1261fe2be5622ef505783353430722
SHA1

f1083911f34adccae4a24773c5da86d09c217bce
SHA256

d18d71389ca1896f5702bbef381508d9eb8e0789f5dc655d9468bc6b84368c01
SHA512

2443fc1ff2b7fbac22439db84bf995167b079b39de4435cf57ab337494ba55b31bd8ea8c3edd45a9ed022284c54aecadf881c6f6dc45f3a24fee5eee6c80bf06
SSDEEP

1536:X8tTjM6nU0GgAz1I0P1kNmIMhdu8KWP/nTn8nB59VewNeG0h/l:aTj5nU0GgAO98t

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1108	1320	WerFault.exe	23

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1320	d18d71389ca1896f5702bbef381508d9eb8e0789f5dc655d9468bc6b84368c01.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 1108	1320	d18d71389ca1896f5702bbef381508d9eb8e0789f5dc655d9468bc6b84368c01.exe	27
PID 1320 wrote to memory of 1108	1320	d18d71389ca1896f5702bbef381508d9eb8e0789f5dc655d9468bc6b84368c01.exe	27
PID 1320 wrote to memory of 1108	1320	d18d71389ca1896f5702bbef381508d9eb8e0789f5dc655d9468bc6b84368c01.exe	27
PID 1320 wrote to memory of 1108	1320	d18d71389ca1896f5702bbef381508d9eb8e0789f5dc655d9468bc6b84368c01.exe	27

C:\Users\Admin\AppData\Local\Temp\d18d71389ca1896f5702bbef381508d9eb8e0789f5dc655d9468bc6b84368c01.exe
"C:\Users\Admin\AppData\Local\Temp\d18d71389ca1896f5702bbef381508d9eb8e0789f5dc655d9468bc6b84368c01.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 188
  2⤵
  - Program crash
  PID:1108