eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 15:03

Target

eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83.exe
Size

936KB
MD5

93e66b232db5707cfdb6bd4a6f6141a8
SHA1

41ee0761fbcc529bd80a24dc48dac7474c03d393
SHA256

eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83
SHA512

bafb91d6cdc1434463de012c8f7b02647271d1b4b3e6db0926ba9ad1b84072c75aac7157b19e8d7a10c7361d242a162143f5f36f153be957a2e109f0c837953d
SSDEEP

12288:R2PG1oyGoIkdYcDuxV14yn5LK4lGiygau9iCcIAZ1IZ3pRD:R2PG1oyGQk34y5LRlhaucCTAoFpRD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1312	1712	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1712	eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83.exe
1712	eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83.exe
1712	eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83.exe
1712	eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83.exe
1712	eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83.exe
1712	eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83.exe
1712	eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83.exe
1712	eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83.exe
1712	eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83.exe
1712	eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83.exe
1712	eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83.exe
1712	eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83.exe
1712	eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83.exe
1712	eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1712	eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83.exe
1712	eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83.exe
1712	eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1312	1712	eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83.exe	27
PID 1712 wrote to memory of 1312	1712	eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83.exe	27
PID 1712 wrote to memory of 1312	1712	eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83.exe	27
PID 1712 wrote to memory of 1312	1712	eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83.exe	27

C:\Users\Admin\AppData\Local\Temp\eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83.exe
"C:\Users\Admin\AppData\Local\Temp\eee265776340e154e9a9a4b70fada352ed75d6da8ab85dd102b3143d27edeb83.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 336
  2⤵
  - Program crash
  PID:1312

memory/1712-54-0x00000000765B1000-0x00000000765B3000-memory.dmp

Filesize
8KB

Download