5c7e848b3b5bf1bc511ff2701f6ea0215b4ebb7581aa3e41b200115eebb676d4

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/12/2022, 08:53

Target

892-69-0x0000000000400000-0x0000000000472000-memory.exe
Size

456KB
MD5

b45e6f14f7744c1432221c99c88e9aa3
SHA1

880d90876f3e194671c4cbc769c837f4606bb6a5
SHA256

5c7e848b3b5bf1bc511ff2701f6ea0215b4ebb7581aa3e41b200115eebb676d4
SHA512

56fdf387856c2aa4dc05675e900549d9b70cb5d0558550e97f46865ba7c45fcf663f095f78b3eae0e3c2623820c5f4c31d421f8699ea7b697f8943ce7a274a4a
SSDEEP

12288:5WnxfgsRL4u/1AlLK6FRY2n8OPKxGvYmB:GxgsRftD0C2nKG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1836	1076	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1076	892-69-0x0000000000400000-0x0000000000472000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 1836	1076	892-69-0x0000000000400000-0x0000000000472000-memory.exe	28
PID 1076 wrote to memory of 1836	1076	892-69-0x0000000000400000-0x0000000000472000-memory.exe	28
PID 1076 wrote to memory of 1836	1076	892-69-0x0000000000400000-0x0000000000472000-memory.exe	28
PID 1076 wrote to memory of 1836	1076	892-69-0x0000000000400000-0x0000000000472000-memory.exe	28

C:\Users\Admin\AppData\Local\Temp\892-69-0x0000000000400000-0x0000000000472000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\892-69-0x0000000000400000-0x0000000000472000-memory.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 188
  2⤵
  - Program crash
  PID:1836