5a76e173c1258735556b046a0832d77dd5177de7aecf898ed2cb62a4632e144d

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
05/10/2023, 18:52

Target

5a76e173c1258735556b046a0832d77dd5177de7aecf898ed2cb62a4632e144d.exe
Size

4.9MB
MD5

3def163a9bccd8768e35570236aa5ed4
SHA1

be8ccb71855bb8d30a7a281178ee63176e537718
SHA256

5a76e173c1258735556b046a0832d77dd5177de7aecf898ed2cb62a4632e144d
SHA512

076095678b6901132dba65edb899bc097ce121941441eae48bcf8e63e56631ec0a7d5f6bee93a3fa7236ebde8c0d091a7d80fe41bb2dd5c194a464b69580bbbe
SSDEEP

49152:1ZnbkE0aVW5gNEz1ERjYD1zpxb1aHU9Zj3Fi+s8KuqGaX0ToIBAUZLYCFd:ojaVQgNTSwHU9Z7JBAUZLJP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2268	2032	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2032	5a76e173c1258735556b046a0832d77dd5177de7aecf898ed2cb62a4632e144d.exe
2032	5a76e173c1258735556b046a0832d77dd5177de7aecf898ed2cb62a4632e144d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2268	2032	5a76e173c1258735556b046a0832d77dd5177de7aecf898ed2cb62a4632e144d.exe	28
PID 2032 wrote to memory of 2268	2032	5a76e173c1258735556b046a0832d77dd5177de7aecf898ed2cb62a4632e144d.exe	28
PID 2032 wrote to memory of 2268	2032	5a76e173c1258735556b046a0832d77dd5177de7aecf898ed2cb62a4632e144d.exe	28
PID 2032 wrote to memory of 2268	2032	5a76e173c1258735556b046a0832d77dd5177de7aecf898ed2cb62a4632e144d.exe	28

C:\Users\Admin\AppData\Local\Temp\5a76e173c1258735556b046a0832d77dd5177de7aecf898ed2cb62a4632e144d.exe
"C:\Users\Admin\AppData\Local\Temp\5a76e173c1258735556b046a0832d77dd5177de7aecf898ed2cb62a4632e144d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 268
  2⤵
  - Program crash
  PID:2268