004c6a4e8ab1e58556dd0e62cdfbfad9ce82f7e7a9705c44258457c585d4e7be

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14-02-2023 19:50

Target

004c6a4e8ab1e58556dd0e62cdfbfad9ce82f7e7a9705c44258457c585d4e7be.exe
Size

4.2MB
MD5

dcf024016497be1db9e82e150b4fbd9b
SHA1

093bd1735140cd9218797d31e817346ac31a6d80
SHA256

004c6a4e8ab1e58556dd0e62cdfbfad9ce82f7e7a9705c44258457c585d4e7be
SHA512

b03a212b7aadf7720c3b43fc3a8e8464dc73db256fbf8e3060dc5182490c342e9b867c1cd98309e34418b6ea41bbbc0f6fde002a0f7b660174a43c6ad0ecc724
SSDEEP

98304:gkFi6n5Vc1QInIps/n7kxYrQXHp/mw9hpDfpOeFiHxp/m2DGmH:gkFi6n5Slx7knmspDfpviRpz

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1756 1948 WerFault.exe 004c6a4e8ab1e58556dd0e62cdfbfad9ce82f7e7a9705c44258457c585d4e7be.exe

pid	pid_target	process	target process
1756	1948	WerFault.exe	004c6a4e8ab1e58556dd0e62cdfbfad9ce82f7e7a9705c44258457c585d4e7be.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

004c6a4e8ab1e58556dd0e62cdfbfad9ce82f7e7a9705c44258457c585d4e7be.exe

pid	process
1948	004c6a4e8ab1e58556dd0e62cdfbfad9ce82f7e7a9705c44258457c585d4e7be.exe
1948	004c6a4e8ab1e58556dd0e62cdfbfad9ce82f7e7a9705c44258457c585d4e7be.exe
1948	004c6a4e8ab1e58556dd0e62cdfbfad9ce82f7e7a9705c44258457c585d4e7be.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

004c6a4e8ab1e58556dd0e62cdfbfad9ce82f7e7a9705c44258457c585d4e7be.exe

description	pid	process	target process
PID 1948 wrote to memory of 1756	1948	004c6a4e8ab1e58556dd0e62cdfbfad9ce82f7e7a9705c44258457c585d4e7be.exe	WerFault.exe
PID 1948 wrote to memory of 1756	1948	004c6a4e8ab1e58556dd0e62cdfbfad9ce82f7e7a9705c44258457c585d4e7be.exe	WerFault.exe
PID 1948 wrote to memory of 1756	1948	004c6a4e8ab1e58556dd0e62cdfbfad9ce82f7e7a9705c44258457c585d4e7be.exe	WerFault.exe
PID 1948 wrote to memory of 1756	1948	004c6a4e8ab1e58556dd0e62cdfbfad9ce82f7e7a9705c44258457c585d4e7be.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 420
2⤵
- Program crash
PID:1756

memory/1756-67-0x0000000000000000-mapping.dmp

Download
memory/1948-61-0x0000000000400000-0x000000000100B000-memory.dmp

Filesize
12.0MB

Download
memory/1948-60-0x0000000002850000-0x0000000002990000-memory.dmp

Filesize
1.2MB

Download
memory/1948-57-0x0000000000400000-0x000000000100B000-memory.dmp

Filesize
12.0MB

Download
memory/1948-58-0x0000000000400000-0x000000000100B000-memory.dmp

Filesize
12.0MB

Download
memory/1948-59-0x0000000000400000-0x000000000100B000-memory.dmp

Filesize
12.0MB

Download
memory/1948-54-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/1948-62-0x0000000002850000-0x0000000002990000-memory.dmp

Filesize
1.2MB

Download
memory/1948-56-0x0000000000400000-0x000000000100B000-memory.dmp

Filesize
12.0MB

Download
memory/1948-63-0x0000000002850000-0x0000000002990000-memory.dmp

Filesize
1.2MB

Download
memory/1948-64-0x0000000002850000-0x0000000002990000-memory.dmp

Filesize
1.2MB

Download
memory/1948-65-0x0000000002850000-0x0000000002990000-memory.dmp

Filesize
1.2MB

Download
memory/1948-66-0x0000000002850000-0x0000000002990000-memory.dmp

Filesize
1.2MB

Download
memory/1948-55-0x0000000000400000-0x000000000100B000-memory.dmp

Filesize
12.0MB

Download
memory/1948-68-0x0000000000400000-0x000000000100B000-memory.dmp

Filesize
12.0MB

Download