bd2127c47a4060c43ca077a3fae55b47832118a1e1a30134ecceafa050a8db4d

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 10:53

Target

bd2127c47a4060c43ca077a3fae55b47832118a1e1a30134ecceafa050a8db4d.exe
Size

96KB
MD5

63b5608e6f2ac916b3d4274206c832ac
SHA1

3ff8b0564d58781fc24a7467e108fb869a2e1342
SHA256

bd2127c47a4060c43ca077a3fae55b47832118a1e1a30134ecceafa050a8db4d
SHA512

b6c83b124409fae789443042adb4d3e7c47e8072fa4208fa3bd75fadd7bfc99e0522906ef068c18d313289563cbbc241ac02fa8f645148e0e3f0eaf4211ccbd3
SSDEEP

1536:OsQBHEf6cO/hLkGulSc16l6u+NMMl/KlYv1Tq5ThFQNIjnZs:Inh0lu8CFFQCnK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1356	1192	WerFault.exe	26

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1192	bd2127c47a4060c43ca077a3fae55b47832118a1e1a30134ecceafa050a8db4d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 1356	1192	bd2127c47a4060c43ca077a3fae55b47832118a1e1a30134ecceafa050a8db4d.exe	27
PID 1192 wrote to memory of 1356	1192	bd2127c47a4060c43ca077a3fae55b47832118a1e1a30134ecceafa050a8db4d.exe	27
PID 1192 wrote to memory of 1356	1192	bd2127c47a4060c43ca077a3fae55b47832118a1e1a30134ecceafa050a8db4d.exe	27
PID 1192 wrote to memory of 1356	1192	bd2127c47a4060c43ca077a3fae55b47832118a1e1a30134ecceafa050a8db4d.exe	27

C:\Users\Admin\AppData\Local\Temp\bd2127c47a4060c43ca077a3fae55b47832118a1e1a30134ecceafa050a8db4d.exe
"C:\Users\Admin\AppData\Local\Temp\bd2127c47a4060c43ca077a3fae55b47832118a1e1a30134ecceafa050a8db4d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 188
  2⤵
  - Program crash
  PID:1356