5bebc1097ad64d9505622196455643e56253168f3c1a534e028d8a2f4a13173c

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 10:08

Target

5bebc1097ad64d9505622196455643e56253168f3c1a534e028d8a2f4a13173c.exe
Size

96KB
MD5

22b5b17a031b530384fe8eb933bd91c2
SHA1

5048aecf89f5ac5d9f13ecb35d3c82d3b9b5aecc
SHA256

5bebc1097ad64d9505622196455643e56253168f3c1a534e028d8a2f4a13173c
SHA512

326bdcb5f6642ffce910e1fd89aa32688325b0398c11ac2bd41dabd22e79e7ac343712a762bb689df785177f03a4b0dba6f5cd688fab1efda1ddcf4cb5a62e9f
SSDEEP

1536:P8xEg52m9tyVQO8P8ych12wjj3RJNEo/knRzdnynE7RldNEP8lijOewNIj/:P4E/melych1/zR3Ek65RldqwC/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1732	752	WerFault.exe	7

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
752	5bebc1097ad64d9505622196455643e56253168f3c1a534e028d8a2f4a13173c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 1732	752	5bebc1097ad64d9505622196455643e56253168f3c1a534e028d8a2f4a13173c.exe	27
PID 752 wrote to memory of 1732	752	5bebc1097ad64d9505622196455643e56253168f3c1a534e028d8a2f4a13173c.exe	27
PID 752 wrote to memory of 1732	752	5bebc1097ad64d9505622196455643e56253168f3c1a534e028d8a2f4a13173c.exe	27
PID 752 wrote to memory of 1732	752	5bebc1097ad64d9505622196455643e56253168f3c1a534e028d8a2f4a13173c.exe	27

C:\Users\Admin\AppData\Local\Temp\5bebc1097ad64d9505622196455643e56253168f3c1a534e028d8a2f4a13173c.exe
"C:\Users\Admin\AppData\Local\Temp\5bebc1097ad64d9505622196455643e56253168f3c1a534e028d8a2f4a13173c.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 188
  2⤵
  - Program crash
  PID:1732