e0b8ce3eb6574b79a103739f1aa1532183d5cc5dfc9c5f0ee1232815f971c217

Analysis

max time kernel
23s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/12/2022, 01:26

Target

e0b8ce3eb6574b79a103739f1aa1532183d5cc5dfc9c5f0ee1232815f971c217.exe
Size

36KB
MD5

2a856c0b55415836a010a878204e0983
SHA1

45eff4b385c123863e5b0039e4b6b198bd2ac5d0
SHA256

e0b8ce3eb6574b79a103739f1aa1532183d5cc5dfc9c5f0ee1232815f971c217
SHA512

1821c744bfc36d26cb9d9b13c019ba9ebb4c97da84ef359b82f3d19601db7d20fa0208485ef308cf4e2eda4230b17a38cf31821496cf55f05207468f39576372
SSDEEP

384:AnjhgGTZoZsV2t0+55dO9jnO7e4Wh17cU9Rgdav5aqK0l0Or59sleJ:AjhLS9J5vO9jnO7e4Ix92daDHzbJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1764	1340	WerFault.exe	27

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1340	e0b8ce3eb6574b79a103739f1aa1532183d5cc5dfc9c5f0ee1232815f971c217.exe
1340	e0b8ce3eb6574b79a103739f1aa1532183d5cc5dfc9c5f0ee1232815f971c217.exe
1340	e0b8ce3eb6574b79a103739f1aa1532183d5cc5dfc9c5f0ee1232815f971c217.exe
1340	e0b8ce3eb6574b79a103739f1aa1532183d5cc5dfc9c5f0ee1232815f971c217.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1764	1340	e0b8ce3eb6574b79a103739f1aa1532183d5cc5dfc9c5f0ee1232815f971c217.exe	29
PID 1340 wrote to memory of 1764	1340	e0b8ce3eb6574b79a103739f1aa1532183d5cc5dfc9c5f0ee1232815f971c217.exe	29
PID 1340 wrote to memory of 1764	1340	e0b8ce3eb6574b79a103739f1aa1532183d5cc5dfc9c5f0ee1232815f971c217.exe	29
PID 1340 wrote to memory of 1764	1340	e0b8ce3eb6574b79a103739f1aa1532183d5cc5dfc9c5f0ee1232815f971c217.exe	29

C:\Users\Admin\AppData\Local\Temp\e0b8ce3eb6574b79a103739f1aa1532183d5cc5dfc9c5f0ee1232815f971c217.exe
"C:\Users\Admin\AppData\Local\Temp\e0b8ce3eb6574b79a103739f1aa1532183d5cc5dfc9c5f0ee1232815f971c217.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 820
  2⤵
  - Program crash
  PID:1764

memory/1340-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download