8e10c155540f98de8f5491a86b5ad9e8bb72b8076b552cd70b4f76761137d134

Analysis

max time kernel
43s
max time network
131s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/02/2023, 02:34

Target

8e10c155540f98de8f5491a86b5ad9e8bb72b8076b552cd70b4f76761137d134.exe
Size

5.1MB
MD5

2a7498bee8117fead5085636655c1669
SHA1

33964e3b0ff3002778f1488bcedd10d1dcb84d08
SHA256

8e10c155540f98de8f5491a86b5ad9e8bb72b8076b552cd70b4f76761137d134
SHA512

af2d64129923c54f11570d8af932ce7766dc419badb3d58ea254059f5ed5d018595c195cb864146ccbd72d3eade1e0deed2ef61c1c38de548f875394276a3813
SSDEEP

98304:gmwDRRTdpRTWTHTHQZvqRRTdpRTWTHTp:gPDRRTdpRTWTHTH+vqRRTdpRTWTHTp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
304	1084	WerFault.exe	26

Suspicious use of SetWindowsHookEx 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 304	1084	8e10c155540f98de8f5491a86b5ad9e8bb72b8076b552cd70b4f76761137d134.exe	27
PID 1084 wrote to memory of 304	1084	8e10c155540f98de8f5491a86b5ad9e8bb72b8076b552cd70b4f76761137d134.exe	27
PID 1084 wrote to memory of 304	1084	8e10c155540f98de8f5491a86b5ad9e8bb72b8076b552cd70b4f76761137d134.exe	27
PID 1084 wrote to memory of 304	1084	8e10c155540f98de8f5491a86b5ad9e8bb72b8076b552cd70b4f76761137d134.exe	27

C:\Users\Admin\AppData\Local\Temp\8e10c155540f98de8f5491a86b5ad9e8bb72b8076b552cd70b4f76761137d134.exe
"C:\Users\Admin\AppData\Local\Temp\8e10c155540f98de8f5491a86b5ad9e8bb72b8076b552cd70b4f76761137d134.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 300
  2⤵
  - Program crash
  PID:304

memory/1084-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1084-56-0x0000000000400000-0x0000000000929000-memory.dmp

Filesize
5.2MB

Download