dafd30917621f8bd8f2bb38e4f5cbdbde1913e802a607fae907d548345877bfa

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 10:42

Target

dafd30917621f8bd8f2bb38e4f5cbdbde1913e802a607fae907d548345877bfa.exe
Size

340KB
MD5

80b5f8856837eecc2e5de11a89708326
SHA1

75c934c318af9b5e86d3a505253a25d4b1a2a5c9
SHA256

dafd30917621f8bd8f2bb38e4f5cbdbde1913e802a607fae907d548345877bfa
SHA512

0c3c326a34f0f8ba441e7fdf5bb35a577f084135e5de7e8703d8445f25798b3d657d58ca2017cb56f96531de8f028df9020f7092b08d50492777e8c8f622b518
SSDEEP

6144:r7Cbe1g/q31zHCt/ypeYkmjwmR5FCd3rBoNUSd8pNIfDoWuEr/gPf:r7wdq3QoOmZS3doNUSmjk0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1776	800	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
800	dafd30917621f8bd8f2bb38e4f5cbdbde1913e802a607fae907d548345877bfa.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 1776	800	dafd30917621f8bd8f2bb38e4f5cbdbde1913e802a607fae907d548345877bfa.exe	28
PID 800 wrote to memory of 1776	800	dafd30917621f8bd8f2bb38e4f5cbdbde1913e802a607fae907d548345877bfa.exe	28
PID 800 wrote to memory of 1776	800	dafd30917621f8bd8f2bb38e4f5cbdbde1913e802a607fae907d548345877bfa.exe	28
PID 800 wrote to memory of 1776	800	dafd30917621f8bd8f2bb38e4f5cbdbde1913e802a607fae907d548345877bfa.exe	28

C:\Users\Admin\AppData\Local\Temp\dafd30917621f8bd8f2bb38e4f5cbdbde1913e802a607fae907d548345877bfa.exe
"C:\Users\Admin\AppData\Local\Temp\dafd30917621f8bd8f2bb38e4f5cbdbde1913e802a607fae907d548345877bfa.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 192
  2⤵
  - Program crash
  PID:1776

memory/800-57-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download