ce29dc2eb0dc01869c94fd19f1c8cad933b10522bbdb51d0479c22300e4bceac

Analysis

max time kernel
24s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 04:37

Target

ce29dc2eb0dc01869c94fd19f1c8cad933b10522bbdb51d0479c22300e4bceac.exe
Size

127KB
MD5

69dd37434c1bfc45cb788f98876d1a58
SHA1

24c4af82ffd278f066b546a109fdcc8d2fca1cc2
SHA256

ce29dc2eb0dc01869c94fd19f1c8cad933b10522bbdb51d0479c22300e4bceac
SHA512

19b734c858da3bc350c27ac924bd9f60aeb8a26c3492b97ee7764f5b5f330c547e61c90b3092b388df25c9b2e3216610d123ae44201201bbcfac03e33905b03f
SSDEEP

3072:2LH/PmVJZubah/hZnIweLZz5lOBscF3o4P:2r+VJcqhFkLZNy3bP

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1600	ce29dc2eb0dc01869c94fd19f1c8cad933b10522bbdb51d0479c22300e4bceac.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1732	1600	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1732	1600	ce29dc2eb0dc01869c94fd19f1c8cad933b10522bbdb51d0479c22300e4bceac.exe	27
PID 1600 wrote to memory of 1732	1600	ce29dc2eb0dc01869c94fd19f1c8cad933b10522bbdb51d0479c22300e4bceac.exe	27
PID 1600 wrote to memory of 1732	1600	ce29dc2eb0dc01869c94fd19f1c8cad933b10522bbdb51d0479c22300e4bceac.exe	27
PID 1600 wrote to memory of 1732	1600	ce29dc2eb0dc01869c94fd19f1c8cad933b10522bbdb51d0479c22300e4bceac.exe	27

C:\Users\Admin\AppData\Local\Temp\ce29dc2eb0dc01869c94fd19f1c8cad933b10522bbdb51d0479c22300e4bceac.exe
"C:\Users\Admin\AppData\Local\Temp\ce29dc2eb0dc01869c94fd19f1c8cad933b10522bbdb51d0479c22300e4bceac.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 44
  2⤵
  - Program crash
  PID:1732

memory/1600-55-0x0000000001000000-0x0000000001021F1E-memory.dmp

Filesize
135KB

Download