3b3b8834993b486e8fae9262f34dd30ea56b7195dddfa5e2899a070fa281397c

Analysis

max time kernel
141s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2023, 10:30

Target

37df748ccc2203exeexe_JC.exe
Size

238KB
MD5

37df748ccc2203dd389fa151a1b008b8
SHA1

99ec386fac7f14b9be6ba06964b12e3d13fb9a0a
SHA256

3b3b8834993b486e8fae9262f34dd30ea56b7195dddfa5e2899a070fa281397c
SHA512

72a8c5a7c84a8ed0a092a3d1e5471019f8ccb3277623755de1abab7baaa7d0cc309a96a50df236d649ae745d67d7c159de9885fa7960a47e25a52bd75c183fd0
SSDEEP

3072:lxUm75Fku3eKeO213SJReOqdmErj+HyHnNVIPL/+ybbiW1u46Q7qV3lU8xM:fU8Dk11CJ1qDWUNVIT/bblS9x

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5064	.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\.exe	37df748ccc2203exeexe_JC.exe
File opened for modification	C:\Program Files\.exe	37df748ccc2203exeexe_JC.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1332	5096	WerFault.exe	83
2196	5096	WerFault.exe	83

Suspicious use of SetWindowsHookEx 8 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 5064	5096	37df748ccc2203exeexe_JC.exe	86
PID 5096 wrote to memory of 5064	5096	37df748ccc2203exeexe_JC.exe	86
PID 5096 wrote to memory of 5064	5096	37df748ccc2203exeexe_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\37df748ccc2203exeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\37df748ccc2203exeexe_JC.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Program Files\.exe
  "C:\Program Files\\.exe" "33201"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 1036
  2⤵
  - Program crash
  PID:1332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 1044
  2⤵
  - Program crash
  PID:2196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5096 -ip 5096
1⤵
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5096 -ip 5096
1⤵
PID:4596

C:\Program Files\.exe

Filesize
238KB

MD5
190f1591bf79d11e3e1dfd7154d5f935

SHA1
3c7a2c7aa3b06a4c5dfdd84db9b00d0677f9cf6c

SHA256
de3f3745489f98cace257fad3dfea8cedccae66a76eae393e1afea3feef749d8

SHA512
0e7d77c7ed0032a93e8df34d9b7d39d3f2d42912c2f6131f22bc256821916c61c1903f6d340093eafb34a3a71c8250c1da6180474969c3f688184fce2fc356f9

Download Submit
C:\Program Files\.exe

Filesize
238KB

MD5
190f1591bf79d11e3e1dfd7154d5f935

SHA1
3c7a2c7aa3b06a4c5dfdd84db9b00d0677f9cf6c

SHA256
de3f3745489f98cace257fad3dfea8cedccae66a76eae393e1afea3feef749d8

SHA512
0e7d77c7ed0032a93e8df34d9b7d39d3f2d42912c2f6131f22bc256821916c61c1903f6d340093eafb34a3a71c8250c1da6180474969c3f688184fce2fc356f9

Download Submit