38336ed96582b4cf87d9301341e4c10090d249aea39603a3bc9c73e7d1bf0634

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24/09/2022, 15:59

Target

Auto Macro Recorder 4.6.2.8(к+ر)/appl.exe
Size

11.3MB
MD5

5251b5c3c834c6819b7ac318b5f5f6f1
SHA1

70e8a6bbe5ae45eedde1524c46929f440c9a03e8
SHA256

ceec0aca48367137f92d3b38fd46cfee29a76fd002cb95951856e8836e6f9e7a
SHA512

97e1e286764c2cc9588a2f0197883fa4ca8196e35f78846b7d336dec04862b7e8ff2a26253093b065848d576c2d4ac890d74854533549998c567ad2b435fa44c
SSDEEP

49152:/ItkwZAb+7oLWnZ6aeHQf2zNB2m/SeCuTyX:QtkwZAb+7oLWnZ6aeHQf2zym/SD3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1092	1884	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1884	appl.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1884	appl.exe
1884	appl.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1092	1884	appl.exe	27
PID 1884 wrote to memory of 1092	1884	appl.exe	27
PID 1884 wrote to memory of 1092	1884	appl.exe	27
PID 1884 wrote to memory of 1092	1884	appl.exe	27

C:\Users\Admin\AppData\Local\Temp\Auto Macro Recorder 4.6.2.8(к+ر)\appl.exe
"C:\Users\Admin\AppData\Local\Temp\Auto Macro Recorder 4.6.2.8(к+ر)\appl.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 416
  2⤵
  - Program crash
  PID:1092

memory/1884-54-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download