844d58d383112e99af0fc5f60401de4006e3ee3512ab58749e41746078c588d7

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20/08/2023, 01:14

Target

2d43d2344e5b6fe2921352f1b601f5f4.exe
Size

4.1MB
MD5

2d43d2344e5b6fe2921352f1b601f5f4
SHA1

b18f78758d2f333380cc50643edf16077506bf29
SHA256

844d58d383112e99af0fc5f60401de4006e3ee3512ab58749e41746078c588d7
SHA512

357b67425c6f3c70a83f3035dd0a5337f33eba66d2f15da552dc1c1bad06204aaa9eaddeaa9a9d5e6abc1a387fbc86b798223a2bc582132557ecd2a2a541201a
SSDEEP

49152:LITi3ioSjFs/hSzA3/IbNB9rQqxPU6BjmkI+vjtIMcs8rtw:UTiSoSjFrzA3/wNB9rlBww

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\netfilter2.sys	2d43d2344e5b6fe2921352f1b601f5f4.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2276	2012	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2012	2d43d2344e5b6fe2921352f1b601f5f4.exe
2012	2d43d2344e5b6fe2921352f1b601f5f4.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2276	2012	2d43d2344e5b6fe2921352f1b601f5f4.exe	28
PID 2012 wrote to memory of 2276	2012	2d43d2344e5b6fe2921352f1b601f5f4.exe	28
PID 2012 wrote to memory of 2276	2012	2d43d2344e5b6fe2921352f1b601f5f4.exe	28
PID 2012 wrote to memory of 2276	2012	2d43d2344e5b6fe2921352f1b601f5f4.exe	28

C:\Users\Admin\AppData\Local\Temp\2d43d2344e5b6fe2921352f1b601f5f4.exe
"C:\Users\Admin\AppData\Local\Temp\2d43d2344e5b6fe2921352f1b601f5f4.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 304
  2⤵
  - Program crash
  PID:2276