6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395

Analysis

max time kernel
140s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20-02-2023 20:27

Target

6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395.exe
Size

466KB
MD5

afc4e290c87a14c777274f8d0207efbe
SHA1

522da5899c8d93d84142664f8d57054a16ffcdf0
SHA256

6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395
SHA512

fa03b8ff34ce28d417f40d0720329b072d6bdaf2473857b0492fd16fa7a11921daebd8e5d76f18973bd635d5e6b07698120280c9c632f9f20e4041e5ad4f482f
SSDEEP

12288:RBmcc97rfYIAeaL358TyQszy0JZXyQ583meHPs:3G97rpg35JEQi6pg

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1420 2032 WerFault.exe 6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395.exe

pid process

2032 6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395.exe

pid	pid_target	process	target process
1420	2032	WerFault.exe	6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395.exe

pid	process
2032	6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395.exe

description	pid	process	target process
PID 2032 wrote to memory of 1420	2032	6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395.exe	WerFault.exe
PID 2032 wrote to memory of 1420	2032	6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395.exe	WerFault.exe
PID 2032 wrote to memory of 1420	2032	6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395.exe	WerFault.exe
PID 2032 wrote to memory of 1420	2032	6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395.exe
"C:\Users\Admin\AppData\Local\Temp\6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 276
  2⤵
  - Program crash
  PID:1420

memory/2032-54-0x0000000000400000-0x0000000000AD3000-memory.dmp

Filesize
6.8MB

Download
memory/2032-55-0x0000000000400000-0x0000000000AD3000-memory.dmp

Filesize
6.8MB

Download
memory/2032-56-0x0000000000400000-0x0000000000AD3000-memory.dmp

Filesize
6.8MB

Download
memory/2032-57-0x0000000000400000-0x0000000000AD3000-memory.dmp

Filesize
6.8MB

Download
memory/2032-58-0x0000000000400000-0x0000000000AD3000-memory.dmp

Filesize
6.8MB

Download