8a9a6796829fe69598bd4a801196880768b0973628033b0a2c4b6c5d76dc3c52

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-10-2022 13:30

Target

8a9a6796829fe69598bd4a801196880768b0973628033b0a2c4b6c5d76dc3c52.exe
Size

775KB
MD5

90f90365f007e71989c80cae676359e0
SHA1

e729a8ef0b7100b6cf9b397610c3dfd2dccb1d27
SHA256

8a9a6796829fe69598bd4a801196880768b0973628033b0a2c4b6c5d76dc3c52
SHA512

32d842c0be32fcce3c003845537f3c0084908eac82b6c7c1211f927f5ac48a12d981e2290d9287e2eb2b0b79891d6f0c3e14131078fbf09cddf0a3fefa9b4616
SSDEEP

24576:4wOlmWzfsw7wFFz0w8gEFGnaNM1JvZEx:0sPL0w8gEdNsvZEx

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1128	8a9a6796829fe69598bd4a801196880768b0973628033b0a2c4b6c5d76dc3c52.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1780	1128	WerFault.exe	26

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1128	8a9a6796829fe69598bd4a801196880768b0973628033b0a2c4b6c5d76dc3c52.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1780	1128	8a9a6796829fe69598bd4a801196880768b0973628033b0a2c4b6c5d76dc3c52.exe	27
PID 1128 wrote to memory of 1780	1128	8a9a6796829fe69598bd4a801196880768b0973628033b0a2c4b6c5d76dc3c52.exe	27
PID 1128 wrote to memory of 1780	1128	8a9a6796829fe69598bd4a801196880768b0973628033b0a2c4b6c5d76dc3c52.exe	27
PID 1128 wrote to memory of 1780	1128	8a9a6796829fe69598bd4a801196880768b0973628033b0a2c4b6c5d76dc3c52.exe	27

C:\Users\Admin\AppData\Local\Temp\8a9a6796829fe69598bd4a801196880768b0973628033b0a2c4b6c5d76dc3c52.exe
"C:\Users\Admin\AppData\Local\Temp\8a9a6796829fe69598bd4a801196880768b0973628033b0a2c4b6c5d76dc3c52.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 276
  2⤵
  - Program crash
  PID:1780

memory/1128-54-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/1128-56-0x0000000000400000-0x0000000000838000-memory.dmp

Filesize
4.2MB

Download