c29778933877dafdaaf15dded16d9c0470f0d49f8b4912c882b72d26c3f5ba5d

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05-06-2023 05:56

Target

c29778933877dafdaaf15dded16d9c0470f0d49f8b4912c882b72d26c3f5ba5d.exe
Size

118KB
MD5

665095a0f49a41b4081f7c091b693ed7
SHA1

4487daa40db0e867b61eb048cfec4c53dcf3015f
SHA256

c29778933877dafdaaf15dded16d9c0470f0d49f8b4912c882b72d26c3f5ba5d
SHA512

6ff7cbeb1876334a66f9ad6eacafa5e4bc89d603b912343c0b6d3dc9f4d8b30057b479ba54d04af2b0f054b649ed5da2d94eed685ddfae02008dd3f9a01cb479
SSDEEP

1536:jFmJzZ9Vl4WJT6dDYdXlEuuyl+9HiJdkXI/ZQN+gC74vqUAstVvhTJ:hmhFlEiEuuo6QW/+17Eq6tVv9J

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1172 1124 WerFault.exe c29778933877dafdaaf15dded16d9c0470f0d49f8b4912c882b72d26c3f5ba5d.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

c29778933877dafdaaf15dded16d9c0470f0d49f8b4912c882b72d26c3f5ba5d.exe

pid process

1124 c29778933877dafdaaf15dded16d9c0470f0d49f8b4912c882b72d26c3f5ba5d.exe

pid	pid_target	process	target process
1172	1124	WerFault.exe	c29778933877dafdaaf15dded16d9c0470f0d49f8b4912c882b72d26c3f5ba5d.exe

pid	process
1124	c29778933877dafdaaf15dded16d9c0470f0d49f8b4912c882b72d26c3f5ba5d.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c29778933877dafdaaf15dded16d9c0470f0d49f8b4912c882b72d26c3f5ba5d.exe

description	pid	process	target process
PID 1124 wrote to memory of 1172	1124	c29778933877dafdaaf15dded16d9c0470f0d49f8b4912c882b72d26c3f5ba5d.exe	WerFault.exe
PID 1124 wrote to memory of 1172	1124	c29778933877dafdaaf15dded16d9c0470f0d49f8b4912c882b72d26c3f5ba5d.exe	WerFault.exe
PID 1124 wrote to memory of 1172	1124	c29778933877dafdaaf15dded16d9c0470f0d49f8b4912c882b72d26c3f5ba5d.exe	WerFault.exe
PID 1124 wrote to memory of 1172	1124	c29778933877dafdaaf15dded16d9c0470f0d49f8b4912c882b72d26c3f5ba5d.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 132
2⤵
- Program crash
PID:1172