215034b7ca273c5dd215de82b55e86b4061656c8778357e5e49bc15884e0f0dd

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 23:40

Target

215034b7ca273c5dd215de82b55e86b4061656c8778357e5e49bc15884e0f0dd.exe
Size

144KB
MD5

83e8b02d72c87b4b5215c14aade2f811
SHA1

060b1b6548acb019a917c0fa418a197fafa68b42
SHA256

215034b7ca273c5dd215de82b55e86b4061656c8778357e5e49bc15884e0f0dd
SHA512

e73f8428a5b340218adc44c9274e0a6ee5df41db2c0fab84619d0c19807510a31c9bf4b36443a994140b011a98b7efd56738bd0f671528633867802104abb2bd
SSDEEP

1536:wLUAcWQa+NWAKxFN1Gt5+tW36jOpB6BYaqL2He4j/SuN6qCjnKpiFZunZv2882AP:wLUEaIO/ZDa+4ejeiFZuUC5I9DjEbscg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1864	1348	WerFault.exe	26

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1348	215034b7ca273c5dd215de82b55e86b4061656c8778357e5e49bc15884e0f0dd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1864	1348	215034b7ca273c5dd215de82b55e86b4061656c8778357e5e49bc15884e0f0dd.exe	27
PID 1348 wrote to memory of 1864	1348	215034b7ca273c5dd215de82b55e86b4061656c8778357e5e49bc15884e0f0dd.exe	27
PID 1348 wrote to memory of 1864	1348	215034b7ca273c5dd215de82b55e86b4061656c8778357e5e49bc15884e0f0dd.exe	27
PID 1348 wrote to memory of 1864	1348	215034b7ca273c5dd215de82b55e86b4061656c8778357e5e49bc15884e0f0dd.exe	27

C:\Users\Admin\AppData\Local\Temp\215034b7ca273c5dd215de82b55e86b4061656c8778357e5e49bc15884e0f0dd.exe
"C:\Users\Admin\AppData\Local\Temp\215034b7ca273c5dd215de82b55e86b4061656c8778357e5e49bc15884e0f0dd.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 188
  2⤵
  - Program crash
  PID:1864

memory/1348-57-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download