971b4c036aacae1cf4099c4894c139fa5f1c37c8def0c6d55c59b6c86890c774

Analysis

max time kernel
27s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05-06-2023 05:56

Target

971b4c036aacae1cf4099c4894c139fa5f1c37c8def0c6d55c59b6c86890c774.exe
Size

202KB
MD5

0568b512a59c9db62aa91c8ef18e862c
SHA1

5852df766674de31b7af25cff4c87bab1f2ba43d
SHA256

971b4c036aacae1cf4099c4894c139fa5f1c37c8def0c6d55c59b6c86890c774
SHA512

513b08b3e3b22ef152aa963225c4851ea16a65197e6f28fd7056c94ed1a13c80a956476f61c73641cb7dda6306ec18351c370455fb9442e6e86ebfe607d5388b
SSDEEP

3072:WmhFlEiEuuo6QW/+17Eq6tVv9mL81gfECQ:WmhFlEQuN+TOlma

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1616 1948 WerFault.exe 971b4c036aacae1cf4099c4894c139fa5f1c37c8def0c6d55c59b6c86890c774.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

971b4c036aacae1cf4099c4894c139fa5f1c37c8def0c6d55c59b6c86890c774.exe

pid process

1948 971b4c036aacae1cf4099c4894c139fa5f1c37c8def0c6d55c59b6c86890c774.exe

pid	pid_target	process	target process
1616	1948	WerFault.exe	971b4c036aacae1cf4099c4894c139fa5f1c37c8def0c6d55c59b6c86890c774.exe

pid	process
1948	971b4c036aacae1cf4099c4894c139fa5f1c37c8def0c6d55c59b6c86890c774.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

971b4c036aacae1cf4099c4894c139fa5f1c37c8def0c6d55c59b6c86890c774.exe

description	pid	process	target process
PID 1948 wrote to memory of 1616	1948	971b4c036aacae1cf4099c4894c139fa5f1c37c8def0c6d55c59b6c86890c774.exe	WerFault.exe
PID 1948 wrote to memory of 1616	1948	971b4c036aacae1cf4099c4894c139fa5f1c37c8def0c6d55c59b6c86890c774.exe	WerFault.exe
PID 1948 wrote to memory of 1616	1948	971b4c036aacae1cf4099c4894c139fa5f1c37c8def0c6d55c59b6c86890c774.exe	WerFault.exe
PID 1948 wrote to memory of 1616	1948	971b4c036aacae1cf4099c4894c139fa5f1c37c8def0c6d55c59b6c86890c774.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 148
2⤵
- Program crash
PID:1616