621aa1243a36c0316c2053a433b516ad08f2a11f11bb069a4e5913a98d89e274

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2023, 11:10

Target

3c0bed4efdb10fexeexe_JC.exe
Size

239KB
MD5

3c0bed4efdb10f7540c4b495af0f6702
SHA1

2214db078596c134dfea10e62148d9a83b505511
SHA256

621aa1243a36c0316c2053a433b516ad08f2a11f11bb069a4e5913a98d89e274
SHA512

f8705fe9dbafba57595c5e485e7c8e1e96edc991f32114fc8ae236869cd3ee1f505e918a89e6a76383ad184733f628b3a0b2dd3fc7038457c5cce12f12162235
SSDEEP

3072:lxUm75Fku3eKeO213SJReOqdmErj+HyHnNVIPL/+ybbiW1u46Q7qV3lU8xM:fU8Dk11CJ1qDWUNVIT/bblS9x

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4724	.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\.exe	3c0bed4efdb10fexeexe_JC.exe
File opened for modification	C:\Program Files\.exe	3c0bed4efdb10fexeexe_JC.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2396	4280	WerFault.exe	84
2316	4280	WerFault.exe	84

Suspicious use of SetWindowsHookEx 8 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 4724	4280	3c0bed4efdb10fexeexe_JC.exe	86
PID 4280 wrote to memory of 4724	4280	3c0bed4efdb10fexeexe_JC.exe	86
PID 4280 wrote to memory of 4724	4280	3c0bed4efdb10fexeexe_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\3c0bed4efdb10fexeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\3c0bed4efdb10fexeexe_JC.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Program Files\.exe
  "C:\Program Files\\.exe" "33201"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 1052
  2⤵
  - Program crash
  PID:2396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 1060
  2⤵
  - Program crash
  PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4280 -ip 4280
1⤵
PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4280 -ip 4280
1⤵
PID:3416

C:\Program Files\.exe

Filesize
239KB

MD5
2f8e75d2118d0ef41c90de3086c65ff8

SHA1
fc9e6a9f6cd67c7d06681479f8b8aac3e135f967

SHA256
f26d8eea2c3c410ef2c2749e1db08ac4a5d4f16841bb44301a8de869c3dfcc37

SHA512
c89cb5ea52dc2278027e7d35d6c5e5d92c14f1152ae2003371c48f9205bd7ceae1b78c41170b4f8204e697b8e5330b5c965851bae524a0eb9444fbc9405ca9da

Download Submit
C:\Program Files\.exe

Filesize
239KB

MD5
2f8e75d2118d0ef41c90de3086c65ff8

SHA1
fc9e6a9f6cd67c7d06681479f8b8aac3e135f967

SHA256
f26d8eea2c3c410ef2c2749e1db08ac4a5d4f16841bb44301a8de869c3dfcc37

SHA512
c89cb5ea52dc2278027e7d35d6c5e5d92c14f1152ae2003371c48f9205bd7ceae1b78c41170b4f8204e697b8e5330b5c965851bae524a0eb9444fbc9405ca9da

Download Submit