fc8e09cf3f61c09ab62e0392d2eb28f7df7a03886fb9e5508e018f963e6d49fb

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
05/07/2023, 19:47

Target

fc8e09cf3f61c09ab62e0392d2eb28f7df7a03886fb9e5508e018f963e6d49fb.exe
Size

1.0MB
MD5

09b927368e15bb3d3f7c16b55f03189b
SHA1

abb91ac4b1a1537fdd130e8beba9732f379dba85
SHA256

fc8e09cf3f61c09ab62e0392d2eb28f7df7a03886fb9e5508e018f963e6d49fb
SHA512

64d5c81a638e657dacaf1ad490515b7374892cff095bca56609bc393337fcb3896a1c2eb611ef688936dd6f7f65960990d3fb380dddd54501e643c09a6a210f3
SSDEEP

12288:q960q8k9lxfHCpnaJ9HYpDcmcaPUvDoYZt2F1yk1Hu+/xlZrhgNnGWD+cXEUa7dv:q96b7d7HYF3Y/2XxX9IpUV7

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2872	fc8e09cf3f61c09ab62e0392d2eb28f7df7a03886fb9e5508e018f963e6d49fb.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
736	2872	WerFault.exe	28

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2872	fc8e09cf3f61c09ab62e0392d2eb28f7df7a03886fb9e5508e018f963e6d49fb.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2872	fc8e09cf3f61c09ab62e0392d2eb28f7df7a03886fb9e5508e018f963e6d49fb.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2872	fc8e09cf3f61c09ab62e0392d2eb28f7df7a03886fb9e5508e018f963e6d49fb.exe
2872	fc8e09cf3f61c09ab62e0392d2eb28f7df7a03886fb9e5508e018f963e6d49fb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 736	2872	fc8e09cf3f61c09ab62e0392d2eb28f7df7a03886fb9e5508e018f963e6d49fb.exe	29
PID 2872 wrote to memory of 736	2872	fc8e09cf3f61c09ab62e0392d2eb28f7df7a03886fb9e5508e018f963e6d49fb.exe	29
PID 2872 wrote to memory of 736	2872	fc8e09cf3f61c09ab62e0392d2eb28f7df7a03886fb9e5508e018f963e6d49fb.exe	29
PID 2872 wrote to memory of 736	2872	fc8e09cf3f61c09ab62e0392d2eb28f7df7a03886fb9e5508e018f963e6d49fb.exe	29

C:\Users\Admin\AppData\Local\Temp\fc8e09cf3f61c09ab62e0392d2eb28f7df7a03886fb9e5508e018f963e6d49fb.exe
"C:\Users\Admin\AppData\Local\Temp\fc8e09cf3f61c09ab62e0392d2eb28f7df7a03886fb9e5508e018f963e6d49fb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 280
  2⤵
  - Program crash
  PID:736

\Users\Admin\AppData\Local\Temp\ufddll.dll

Filesize
224KB

MD5
e5b37204f58ccbd6d7139fa552d0bfc6

SHA1
41fb78aa578681aa0153a492ad9c3c40890b7a25

SHA256
a077dcb483af9af43e7e36a899441c45d0197a6f3578862801ce2a4d766b8d98

SHA512
8fa706972484bd7c65439c2f19fbf837fcfa28af6fc4a5d843a33a0e84ff3fa6c441b164378c9b34fbc35708844544f1d895bec477fc291584bc39a494402e77

Download Submit