72d4aa2991b3c7d427eba8a983d91c1256a92be66d139c224d7dd89f82a88985

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
28/08/2023, 05:24

Target

72d4aa2991b3c7d427eba8a983d91c1256a92be66d139c224d7dd89f82a88985.exe
Size

1.9MB
MD5

b57f9a22ade58e4c0f8da88d1c1a8a59
SHA1

b8a3a7fc4a5836d30dd6248f67659317468de986
SHA256

72d4aa2991b3c7d427eba8a983d91c1256a92be66d139c224d7dd89f82a88985
SHA512

4060c9768adcb6fbd6297ca17526b3369bf69204b88336d0db7fe3d5856c5e6ee45cb45348ede794de74103a276ad8160e1bb5bc7cfec4cfe282affba3c6aebd
SSDEEP

49152:a81huxNZIar8BiVBwlmcwknY/ZbJ/5Bqt7rlEbz2+1Ebx89DVR:Jhux/vGiVBwJwknY/ZbJhBqt7rmx1Ebu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1672	2588	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2588	72d4aa2991b3c7d427eba8a983d91c1256a92be66d139c224d7dd89f82a88985.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 1672	2588	72d4aa2991b3c7d427eba8a983d91c1256a92be66d139c224d7dd89f82a88985.exe	28
PID 2588 wrote to memory of 1672	2588	72d4aa2991b3c7d427eba8a983d91c1256a92be66d139c224d7dd89f82a88985.exe	28
PID 2588 wrote to memory of 1672	2588	72d4aa2991b3c7d427eba8a983d91c1256a92be66d139c224d7dd89f82a88985.exe	28
PID 2588 wrote to memory of 1672	2588	72d4aa2991b3c7d427eba8a983d91c1256a92be66d139c224d7dd89f82a88985.exe	28

C:\Users\Admin\AppData\Local\Temp\72d4aa2991b3c7d427eba8a983d91c1256a92be66d139c224d7dd89f82a88985.exe
"C:\Users\Admin\AppData\Local\Temp\72d4aa2991b3c7d427eba8a983d91c1256a92be66d139c224d7dd89f82a88985.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 252
  2⤵
  - Program crash
  PID:1672