488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665

Analysis

max time kernel
5s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 08:29

Target

488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe
Size

218KB
MD5

86bd5b1a7cdc9ff4bed366b70d079099
SHA1

0640d8923bae8025daa01c18a3cca33d998fb50b
SHA256

488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665
SHA512

b5b42249db27c254f61d0f807758ff4c8a7fb46832b185bebd2481fd456fe9830260b4d1ad4d49b57b4d7d0781aae7b0c1adb56b8bbe47239869e6e9e8893d63
SSDEEP

3072:jmhDbwbLVXEQCM4e3KCpKKXNlDr/8N1ZEK4ZLK2SeyhoK3kGqyDkIf6fG2WxxpBv:Sh/wVBCZhZKLgeLKteyt9wIf+SV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	1244	WerFault.exe	18

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{405CD8B9-3E65-4BB0-875D-A3B8247D6EE5}\	488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{405CD8B9-3E65-4BB0-875D-A3B8247D6EE5}	488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1244	488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe
1244	488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2012	1244	488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe	28
PID 1244 wrote to memory of 2012	1244	488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe	28
PID 1244 wrote to memory of 2012	1244	488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe	28
PID 1244 wrote to memory of 2012	1244	488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe	28

C:\Users\Admin\AppData\Local\Temp\488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe
"C:\Users\Admin\AppData\Local\Temp\488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 224
  2⤵
  - Program crash
  PID:2012