b20d485ab28b9a84c63a376b731b70cefd41e10d0d73d5223a7b2ea4bb3b9a87

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/02/2023, 01:41

Target

b20d485ab28b9a84c63a376b731b70cefd41e10d0d73d5223a7b2ea4bb3b9a87.exe
Size

36KB
MD5

8def439355d3f769c5a65c6fabb8c5c7
SHA1

087d86a2af5e9e447c6714157a56116809ade2da
SHA256

b20d485ab28b9a84c63a376b731b70cefd41e10d0d73d5223a7b2ea4bb3b9a87
SHA512

436b0fa3f30d03d12420291d775197baf5f7518fd32e2a4cd9bc16ab2fd4860f06541b01dc8b012078a8501f06ec6f3ad8daf6b52d61386530b8b2cdd5a6c5a1
SSDEEP

192:w7il9XYYJiEtKm6HasTdgr6ZLIikJjlmO3L1jp5ByCB1yPByJO61oyU62i30BuWV:z3dJiEom6kr6WZjp6C3Y61+62fBliXe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	1884	WerFault.exe	26

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1884	b20d485ab28b9a84c63a376b731b70cefd41e10d0d73d5223a7b2ea4bb3b9a87.exe
1884	b20d485ab28b9a84c63a376b731b70cefd41e10d0d73d5223a7b2ea4bb3b9a87.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1696	1884	b20d485ab28b9a84c63a376b731b70cefd41e10d0d73d5223a7b2ea4bb3b9a87.exe	27
PID 1884 wrote to memory of 1696	1884	b20d485ab28b9a84c63a376b731b70cefd41e10d0d73d5223a7b2ea4bb3b9a87.exe	27
PID 1884 wrote to memory of 1696	1884	b20d485ab28b9a84c63a376b731b70cefd41e10d0d73d5223a7b2ea4bb3b9a87.exe	27
PID 1884 wrote to memory of 1696	1884	b20d485ab28b9a84c63a376b731b70cefd41e10d0d73d5223a7b2ea4bb3b9a87.exe	27

C:\Users\Admin\AppData\Local\Temp\b20d485ab28b9a84c63a376b731b70cefd41e10d0d73d5223a7b2ea4bb3b9a87.exe
"C:\Users\Admin\AppData\Local\Temp\b20d485ab28b9a84c63a376b731b70cefd41e10d0d73d5223a7b2ea4bb3b9a87.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 320
  2⤵
  - Program crash
  PID:1696

memory/1884-54-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download