efbe29e7e508ee4a69a8d7d113e52c624cf4e78dc0a8c6d8e74b3b9b86a07ba9

Analysis

max time kernel
142s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 19:16

Target

efbe29e7e508ee4a69a8d7d113e52c624cf4e78dc0a8c6d8e74b3b9b86a07ba9.exe
Size

177KB
MD5

9021ed3f00f1be5bb1a49a14b0ad2120
SHA1

8ad1db39b58f422e3fb58e3bc4eee19842474597
SHA256

efbe29e7e508ee4a69a8d7d113e52c624cf4e78dc0a8c6d8e74b3b9b86a07ba9
SHA512

966c51b3a35260f31c02f51211a5ce4f036569b6f87533665809afe39e0f000c955df5097c568a9ce0fff78d6c108d6e87a466de1acc0e806554a60a6f56a14e
SSDEEP

1536:9C8tA5z5MS62cxVfLVFio+HETUjBEikc94vNUNT+piHJO5cghLjJzK:xAhlbcDziW4/kvfp+oFzK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1528	1044	WerFault.exe	26

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1044	efbe29e7e508ee4a69a8d7d113e52c624cf4e78dc0a8c6d8e74b3b9b86a07ba9.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1528	1044	efbe29e7e508ee4a69a8d7d113e52c624cf4e78dc0a8c6d8e74b3b9b86a07ba9.exe	27
PID 1044 wrote to memory of 1528	1044	efbe29e7e508ee4a69a8d7d113e52c624cf4e78dc0a8c6d8e74b3b9b86a07ba9.exe	27
PID 1044 wrote to memory of 1528	1044	efbe29e7e508ee4a69a8d7d113e52c624cf4e78dc0a8c6d8e74b3b9b86a07ba9.exe	27
PID 1044 wrote to memory of 1528	1044	efbe29e7e508ee4a69a8d7d113e52c624cf4e78dc0a8c6d8e74b3b9b86a07ba9.exe	27

C:\Users\Admin\AppData\Local\Temp\efbe29e7e508ee4a69a8d7d113e52c624cf4e78dc0a8c6d8e74b3b9b86a07ba9.exe
"C:\Users\Admin\AppData\Local\Temp\efbe29e7e508ee4a69a8d7d113e52c624cf4e78dc0a8c6d8e74b3b9b86a07ba9.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 248
  2⤵
  - Program crash
  PID:1528

memory/1044-54-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1044-56-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download