0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08-06-2024 18:48

Target

0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe
Size

2.9MB
MD5

32dfd38036d85d1b0de44e1c6b61cdff
SHA1

d29f730001f6f65b6dfd75682893eef1cbc41b95
SHA256

0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a
SHA512

a4ce001e52022f5aca59af85bd489f141fdb9973214dcc36a86a1704e5ee0ab574d18f4b11c9646c83266c83cd22a16663b671e295c2bf718313ed51652f7da3
SSDEEP

49152:M5JnNd1X1OFPHZXgtN5tI5to9s8Ztl4x/xClHVkmDW/CiC+Z+W:Enh1OFPlTeyCHVzDW/CbS

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2376 384 WerFault.exe 0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe

pid	pid_target	process	target process
2376	384	WerFault.exe	0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe

pid	process
384	0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe
384	0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe

description	pid	process	target process
PID 384 wrote to memory of 2376	384	0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe	WerFault.exe
PID 384 wrote to memory of 2376	384	0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe	WerFault.exe
PID 384 wrote to memory of 2376	384	0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe	WerFault.exe
PID 384 wrote to memory of 2376	384	0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 268
2⤵
- Program crash
PID:2376