d0a87503e2f6d7f2c465777b044fd363b26accc391034d84eb85d0c49c61e56e

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-10-2023 04:00

Target

d0a87503e2f6d7f2c465777b044fd363b26accc391034d84eb85d0c49c61e56e.exe
Size

928KB
MD5

6ad5ed4e03abbf0657c9efd46ea3ea6f
SHA1

4ebda8f10fd659cee0289d4d3c8d1ce4cd06f792
SHA256

d0a87503e2f6d7f2c465777b044fd363b26accc391034d84eb85d0c49c61e56e
SHA512

ecf79339d2092aa3d97e94a27b43d59e9cacc581803b4ae005d17d1a27768a9fa28536aa4d95be8fb7b85cd1d13208ffcf01caa0a41e76d336c7b4eba3985007
SSDEEP

24576:DQX/6RfIsHYuLSGgTm3YnrSEbNvrLW7wUZulV7:DQXCRNYuLSi7wculh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2904	3028	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3028	d0a87503e2f6d7f2c465777b044fd363b26accc391034d84eb85d0c49c61e56e.exe
3028	d0a87503e2f6d7f2c465777b044fd363b26accc391034d84eb85d0c49c61e56e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2904	3028	d0a87503e2f6d7f2c465777b044fd363b26accc391034d84eb85d0c49c61e56e.exe	28
PID 3028 wrote to memory of 2904	3028	d0a87503e2f6d7f2c465777b044fd363b26accc391034d84eb85d0c49c61e56e.exe	28
PID 3028 wrote to memory of 2904	3028	d0a87503e2f6d7f2c465777b044fd363b26accc391034d84eb85d0c49c61e56e.exe	28
PID 3028 wrote to memory of 2904	3028	d0a87503e2f6d7f2c465777b044fd363b26accc391034d84eb85d0c49c61e56e.exe	28

C:\Users\Admin\AppData\Local\Temp\d0a87503e2f6d7f2c465777b044fd363b26accc391034d84eb85d0c49c61e56e.exe
"C:\Users\Admin\AppData\Local\Temp\d0a87503e2f6d7f2c465777b044fd363b26accc391034d84eb85d0c49c61e56e.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 304
  2⤵
  - Program crash
  PID:2904