e666fcb9665c79eace0b0ab584b17aa5d1415f2973e419c1fad292fb4d4d4b6c

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 10:31

Target

e666fcb9665c79eace0b0ab584b17aa5d1415f2973e419c1fad292fb4d4d4b6c.exe
Size

132KB
MD5

c5126db8008727596962d39bce99c77d
SHA1

bd7d5e4d51a47fe685d0255c0cad81f226578a11
SHA256

e666fcb9665c79eace0b0ab584b17aa5d1415f2973e419c1fad292fb4d4d4b6c
SHA512

82ade405952b97a8d9a8dbb69c0e91050faba134853afeea8b4840096264c115e410e606e95234b9f0dfc7aecfbb4a78b0dde4199fbb95e8a4f421d43ec000bd
SSDEEP

3072:E3k/yPrdVfWM8RM/8KmwBErXXFefQmD8ampjrJe:T/mX8/KmwBEjXFeos8aCpe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1332	1768	WerFault.exe	26

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1768	e666fcb9665c79eace0b0ab584b17aa5d1415f2973e419c1fad292fb4d4d4b6c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1332	1768	e666fcb9665c79eace0b0ab584b17aa5d1415f2973e419c1fad292fb4d4d4b6c.exe	27
PID 1768 wrote to memory of 1332	1768	e666fcb9665c79eace0b0ab584b17aa5d1415f2973e419c1fad292fb4d4d4b6c.exe	27
PID 1768 wrote to memory of 1332	1768	e666fcb9665c79eace0b0ab584b17aa5d1415f2973e419c1fad292fb4d4d4b6c.exe	27
PID 1768 wrote to memory of 1332	1768	e666fcb9665c79eace0b0ab584b17aa5d1415f2973e419c1fad292fb4d4d4b6c.exe	27

C:\Users\Admin\AppData\Local\Temp\e666fcb9665c79eace0b0ab584b17aa5d1415f2973e419c1fad292fb4d4d4b6c.exe
"C:\Users\Admin\AppData\Local\Temp\e666fcb9665c79eace0b0ab584b17aa5d1415f2973e419c1fad292fb4d4d4b6c.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 188
  2⤵
  - Program crash
  PID:1332