998774156b8bd600cb4a6b3810539ed837a9681f7ac419eaffcf0d179b3709ab

Analysis

max time kernel
25s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 01:39

Target

998774156b8bd600cb4a6b3810539ed837a9681f7ac419eaffcf0d179b3709ab.exe
Size

684KB
MD5

0180e63f91af5370cb57b50c6e9dc7e0
SHA1

32675b556e8843eb2ba2964c6bbf251c3eefe8fd
SHA256

998774156b8bd600cb4a6b3810539ed837a9681f7ac419eaffcf0d179b3709ab
SHA512

d9933bfeda84d8b6fc865a2726fa508d147dbf5f606833f1a684073bca2a596cf4b1ae88dd265163947b0e679b96eb601eccd5ec86543ddd9b4031a5808e8033
SSDEEP

6144:1CYwO2yBPGNDl8zoFE+VA8Jl/z1SAAoQ32YD1cvmBoeq7LnWl/6VAmONUGdqjNfM:1CYwO28+Nwl4A8Jl/J4WwoeqmgAnNwNO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2044	1880	WerFault.exe	20

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1880	998774156b8bd600cb4a6b3810539ed837a9681f7ac419eaffcf0d179b3709ab.exe
1880	998774156b8bd600cb4a6b3810539ed837a9681f7ac419eaffcf0d179b3709ab.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1880	998774156b8bd600cb4a6b3810539ed837a9681f7ac419eaffcf0d179b3709ab.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1880	998774156b8bd600cb4a6b3810539ed837a9681f7ac419eaffcf0d179b3709ab.exe
1880	998774156b8bd600cb4a6b3810539ed837a9681f7ac419eaffcf0d179b3709ab.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 2044	1880	998774156b8bd600cb4a6b3810539ed837a9681f7ac419eaffcf0d179b3709ab.exe	28
PID 1880 wrote to memory of 2044	1880	998774156b8bd600cb4a6b3810539ed837a9681f7ac419eaffcf0d179b3709ab.exe	28
PID 1880 wrote to memory of 2044	1880	998774156b8bd600cb4a6b3810539ed837a9681f7ac419eaffcf0d179b3709ab.exe	28
PID 1880 wrote to memory of 2044	1880	998774156b8bd600cb4a6b3810539ed837a9681f7ac419eaffcf0d179b3709ab.exe	28

C:\Users\Admin\AppData\Local\Temp\998774156b8bd600cb4a6b3810539ed837a9681f7ac419eaffcf0d179b3709ab.exe
"C:\Users\Admin\AppData\Local\Temp\998774156b8bd600cb4a6b3810539ed837a9681f7ac419eaffcf0d179b3709ab.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 288
  2⤵
  - Program crash
  PID:2044

memory/1880-54-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Filesize
8KB

Download