537f640180dc938e8174a36a962f28274b5300d0a75942d9ab42d25e48ca9f03

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
26-02-2023 19:30

Target

537f640180dc938e8174a36a962f28274b5300d0a75942d9ab42d25e48ca9f03.exe
Size

1.0MB
MD5

570a4061122aefa33f068b6f6b6a0a73
SHA1

56190016fbcbc1c69b08ab4b7f156985192149b7
SHA256

537f640180dc938e8174a36a962f28274b5300d0a75942d9ab42d25e48ca9f03
SHA512

c5d4a9d39d70df7d45ee1fcdb997df9aa5a75d44ca8469a03ccefa9a20baca0f86f64ac37ea01a0ee4c327c17e8449791da2c121055fd1df0ca32207f37aa5fb
SSDEEP

12288:0+XMPDBxHwGgJ9GDd0R7OGK/GUlyeG8aEjHO2WbY7XT6CZI37:0++H3gJcZ27O9/G6ye8ETO2Wbmqr

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

936 1476 WerFault.exe 537f640180dc938e8174a36a962f28274b5300d0a75942d9ab42d25e48ca9f03.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

537f640180dc938e8174a36a962f28274b5300d0a75942d9ab42d25e48ca9f03.exe

pid process

1476 537f640180dc938e8174a36a962f28274b5300d0a75942d9ab42d25e48ca9f03.exe

pid	pid_target	process	target process
936	1476	WerFault.exe	537f640180dc938e8174a36a962f28274b5300d0a75942d9ab42d25e48ca9f03.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

537f640180dc938e8174a36a962f28274b5300d0a75942d9ab42d25e48ca9f03.exe

pid	process
1476	537f640180dc938e8174a36a962f28274b5300d0a75942d9ab42d25e48ca9f03.exe
1476	537f640180dc938e8174a36a962f28274b5300d0a75942d9ab42d25e48ca9f03.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

537f640180dc938e8174a36a962f28274b5300d0a75942d9ab42d25e48ca9f03.exe

description	pid	process	target process
PID 1476 wrote to memory of 936	1476	537f640180dc938e8174a36a962f28274b5300d0a75942d9ab42d25e48ca9f03.exe	WerFault.exe
PID 1476 wrote to memory of 936	1476	537f640180dc938e8174a36a962f28274b5300d0a75942d9ab42d25e48ca9f03.exe	WerFault.exe
PID 1476 wrote to memory of 936	1476	537f640180dc938e8174a36a962f28274b5300d0a75942d9ab42d25e48ca9f03.exe	WerFault.exe
PID 1476 wrote to memory of 936	1476	537f640180dc938e8174a36a962f28274b5300d0a75942d9ab42d25e48ca9f03.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 244
2⤵
- Program crash
PID:936