4db675bc85691160d0c1961d11d3c577e3e27be52ebd9505cc22534fbcb195fb

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
29/06/2023, 19:28

Target

4db675bc85691160d0c1961d11d3c577e3e27be52ebd9505cc22534fbcb195fb.exe
Size

5.3MB
MD5

1f27e738301e176aea449928ea76b138
SHA1

d8b51a2293f059a3efcedde72d4e6651ff5457b6
SHA256

4db675bc85691160d0c1961d11d3c577e3e27be52ebd9505cc22534fbcb195fb
SHA512

10c7e1aa52a786164c613b4f461c6edd9141c894fbf21d2ca96729b5520672a630f89717b15305aa416d32f2a86668c8d60f9545ef9da9d8ae02c195cbc18864
SSDEEP

98304:1Sf15P30KDBqE6NYmnTvUUM1cBx1ZcJ0ztrxNNgkZgZjtE9nNsz:AZ0+JNNc1ZrLWkZgZjtSq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	1756	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1756	4db675bc85691160d0c1961d11d3c577e3e27be52ebd9505cc22534fbcb195fb.exe
1756	4db675bc85691160d0c1961d11d3c577e3e27be52ebd9505cc22534fbcb195fb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2012	1756	4db675bc85691160d0c1961d11d3c577e3e27be52ebd9505cc22534fbcb195fb.exe	28
PID 1756 wrote to memory of 2012	1756	4db675bc85691160d0c1961d11d3c577e3e27be52ebd9505cc22534fbcb195fb.exe	28
PID 1756 wrote to memory of 2012	1756	4db675bc85691160d0c1961d11d3c577e3e27be52ebd9505cc22534fbcb195fb.exe	28
PID 1756 wrote to memory of 2012	1756	4db675bc85691160d0c1961d11d3c577e3e27be52ebd9505cc22534fbcb195fb.exe	28

C:\Users\Admin\AppData\Local\Temp\4db675bc85691160d0c1961d11d3c577e3e27be52ebd9505cc22534fbcb195fb.exe
"C:\Users\Admin\AppData\Local\Temp\4db675bc85691160d0c1961d11d3c577e3e27be52ebd9505cc22534fbcb195fb.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 272
  2⤵
  - Program crash
  PID:2012