ffa4ae1464fa5dfc507995b44a2c28fe12cd46150d17514a09cae6baf0c15543

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15-02-2023 20:21

Target

ffa4ae1464fa5dfc507995b44a2c28fe12cd46150d17514a09cae6baf0c15543.exe
Size

260KB
MD5

a8798f4f9da2238b36eb25f2608ab3b8
SHA1

99aa11d1b0b39ed451c86ae2d5f38e5d81057020
SHA256

ffa4ae1464fa5dfc507995b44a2c28fe12cd46150d17514a09cae6baf0c15543
SHA512

9e419975fe55e532f631ad994641d004ede25284c6389fe044f7ed6cd444cbfe133190af6e01a96470bdc2aa0934b60bf2ff27883a661c36323ffc57a6f7c79b
SSDEEP

6144:H3JQC0VFlepSs1xycRSAztVJvXulAC6kFZC5xKKV5kiKirLZv98:/Z1xhRVd2l6QZC715hKi5

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2032 1404 WerFault.exe ffa4ae1464fa5dfc507995b44a2c28fe12cd46150d17514a09cae6baf0c15543.exe

pid	pid_target	process	target process
2032	1404	WerFault.exe	ffa4ae1464fa5dfc507995b44a2c28fe12cd46150d17514a09cae6baf0c15543.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ffa4ae1464fa5dfc507995b44a2c28fe12cd46150d17514a09cae6baf0c15543.exe

pid	process
1404	ffa4ae1464fa5dfc507995b44a2c28fe12cd46150d17514a09cae6baf0c15543.exe
1404	ffa4ae1464fa5dfc507995b44a2c28fe12cd46150d17514a09cae6baf0c15543.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ffa4ae1464fa5dfc507995b44a2c28fe12cd46150d17514a09cae6baf0c15543.exe

description	pid	process	target process
PID 1404 wrote to memory of 2032	1404	ffa4ae1464fa5dfc507995b44a2c28fe12cd46150d17514a09cae6baf0c15543.exe	WerFault.exe
PID 1404 wrote to memory of 2032	1404	ffa4ae1464fa5dfc507995b44a2c28fe12cd46150d17514a09cae6baf0c15543.exe	WerFault.exe
PID 1404 wrote to memory of 2032	1404	ffa4ae1464fa5dfc507995b44a2c28fe12cd46150d17514a09cae6baf0c15543.exe	WerFault.exe
PID 1404 wrote to memory of 2032	1404	ffa4ae1464fa5dfc507995b44a2c28fe12cd46150d17514a09cae6baf0c15543.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 296
2⤵
- Program crash
PID:2032

memory/1404-54-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1404-55-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1404-56-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1404-57-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1404-59-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2032-58-0x0000000000000000-mapping.dmp

Download