f8ed1d2c9e3ac13f76e180e89ab7929a21134d19a5b2cd848d5fa41cf9dd7127

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
27/08/2023, 05:26

Target

f8ed1d2c9e3ac13f76e180e89ab7929a21134d19a5b2cd848d5fa41cf9dd7127.exe
Size

1.2MB
MD5

d90c9cde3f8a582b86a6d5b1f2be1ac6
SHA1

4d37d16edb1bd4872954b1cdba19fcfb53bb87bd
SHA256

f8ed1d2c9e3ac13f76e180e89ab7929a21134d19a5b2cd848d5fa41cf9dd7127
SHA512

a2f37a08d594b88b293f76c4491cff123f659d8064cb42b59179b4d882192d04a25d5df3e3c210cc01a6690a2ab02b814f115337326e8551943ef654f6f61eda
SSDEEP

24576:a01ElhnesqSco3FjWG+TafTFuKiUR5Z3FwMsTb7DL8:X+giZj3F98z4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1968	2616	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2616	f8ed1d2c9e3ac13f76e180e89ab7929a21134d19a5b2cd848d5fa41cf9dd7127.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 1968	2616	f8ed1d2c9e3ac13f76e180e89ab7929a21134d19a5b2cd848d5fa41cf9dd7127.exe	28
PID 2616 wrote to memory of 1968	2616	f8ed1d2c9e3ac13f76e180e89ab7929a21134d19a5b2cd848d5fa41cf9dd7127.exe	28
PID 2616 wrote to memory of 1968	2616	f8ed1d2c9e3ac13f76e180e89ab7929a21134d19a5b2cd848d5fa41cf9dd7127.exe	28
PID 2616 wrote to memory of 1968	2616	f8ed1d2c9e3ac13f76e180e89ab7929a21134d19a5b2cd848d5fa41cf9dd7127.exe	28

C:\Users\Admin\AppData\Local\Temp\f8ed1d2c9e3ac13f76e180e89ab7929a21134d19a5b2cd848d5fa41cf9dd7127.exe
"C:\Users\Admin\AppData\Local\Temp\f8ed1d2c9e3ac13f76e180e89ab7929a21134d19a5b2cd848d5fa41cf9dd7127.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 188
  2⤵
  - Program crash
  PID:1968