ecb79f4068bdf7cb4201d6b89f4920d7680391998c6c208f06ec6c69a4a6a2f9

Analysis

max time kernel
151s
max time network
34s
platform
windows7_x64
resource
win7-20230705-en
resource tags

arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system
submitted
08/07/2023, 20:17

Target

ecb79f4068bdf7cb4201d6b89f4920d7680391998c6c208f06ec6c69a4a6a2f9.exe
Size

1.8MB
MD5

b691cd587f812a61b54795468348cb73
SHA1

00887e09e76beec5b8e2535f97ddc22702a38268
SHA256

ecb79f4068bdf7cb4201d6b89f4920d7680391998c6c208f06ec6c69a4a6a2f9
SHA512

ac8eb4cdac33726f23c83b442eef19b4a07aae04931d712c47134f2203ab37322bc4061c4203695e8f28ee4a76eddfe97aa9e78b9e1a4bbca7dd1d072b5141e7
SSDEEP

49152:TxSVVWHJwFbQ5Q/NY4dPMm2/PwzC278MLk:QVWHGbt2SMBw78

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2920	2120	WerFault.exe	26

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2120	ecb79f4068bdf7cb4201d6b89f4920d7680391998c6c208f06ec6c69a4a6a2f9.exe
2120	ecb79f4068bdf7cb4201d6b89f4920d7680391998c6c208f06ec6c69a4a6a2f9.exe
2120	ecb79f4068bdf7cb4201d6b89f4920d7680391998c6c208f06ec6c69a4a6a2f9.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2920	2120	ecb79f4068bdf7cb4201d6b89f4920d7680391998c6c208f06ec6c69a4a6a2f9.exe	27
PID 2120 wrote to memory of 2920	2120	ecb79f4068bdf7cb4201d6b89f4920d7680391998c6c208f06ec6c69a4a6a2f9.exe	27
PID 2120 wrote to memory of 2920	2120	ecb79f4068bdf7cb4201d6b89f4920d7680391998c6c208f06ec6c69a4a6a2f9.exe	27
PID 2120 wrote to memory of 2920	2120	ecb79f4068bdf7cb4201d6b89f4920d7680391998c6c208f06ec6c69a4a6a2f9.exe	27

C:\Users\Admin\AppData\Local\Temp\ecb79f4068bdf7cb4201d6b89f4920d7680391998c6c208f06ec6c69a4a6a2f9.exe
"C:\Users\Admin\AppData\Local\Temp\ecb79f4068bdf7cb4201d6b89f4920d7680391998c6c208f06ec6c69a4a6a2f9.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 424
  2⤵
  - Program crash
  PID:2920

memory/2120-54-0x0000000000400000-0x00000000009C3000-memory.dmp

Filesize
5.8MB

Download
memory/2120-55-0x0000000000400000-0x00000000009C3000-memory.dmp

Filesize
5.8MB

Download
memory/2120-56-0x0000000000400000-0x00000000009C3000-memory.dmp

Filesize
5.8MB

Download
memory/2120-57-0x0000000000400000-0x00000000009C3000-memory.dmp

Filesize
5.8MB

Download
memory/2120-58-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2120-59-0x0000000000400000-0x00000000009C3000-memory.dmp

Filesize
5.8MB

Download
memory/2120-60-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download