0e6683934b8b94702a70f5d306e4fa4404f008fefe0d5ba7e05869bfffee3705

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20/08/2023, 21:19

Target

0e6683934b8b94702a70f5d306e4fa4404f008fefe0d5ba7e05869bfffee3705.exe
Size

7.9MB
MD5

ae6bea008757e0611048be27b2ed45ae
SHA1

a4bba57b4e0571b980265ca244585de7d4f6051c
SHA256

0e6683934b8b94702a70f5d306e4fa4404f008fefe0d5ba7e05869bfffee3705
SHA512

1aed4ae350ea8bea075cf243c9aedeb87ddbba81e193f33d6bfe28f25cf773ed331b312cd25f5fecb4c4ef50973180aa57b75cfb14a26d3034b8a4f1b0c2737c
SSDEEP

98304:S2jFuCV3JpZ7l9oLCqqndblBLTckSk95IWSnLDwnemjKq0QEhjTJBAUZLjt:SIdx5hl6kS7WSLDwnxKFQIjTJV1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1952	1712	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1712	0e6683934b8b94702a70f5d306e4fa4404f008fefe0d5ba7e05869bfffee3705.exe
1712	0e6683934b8b94702a70f5d306e4fa4404f008fefe0d5ba7e05869bfffee3705.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1952	1712	0e6683934b8b94702a70f5d306e4fa4404f008fefe0d5ba7e05869bfffee3705.exe	28
PID 1712 wrote to memory of 1952	1712	0e6683934b8b94702a70f5d306e4fa4404f008fefe0d5ba7e05869bfffee3705.exe	28
PID 1712 wrote to memory of 1952	1712	0e6683934b8b94702a70f5d306e4fa4404f008fefe0d5ba7e05869bfffee3705.exe	28
PID 1712 wrote to memory of 1952	1712	0e6683934b8b94702a70f5d306e4fa4404f008fefe0d5ba7e05869bfffee3705.exe	28

C:\Users\Admin\AppData\Local\Temp\0e6683934b8b94702a70f5d306e4fa4404f008fefe0d5ba7e05869bfffee3705.exe
"C:\Users\Admin\AppData\Local\Temp\0e6683934b8b94702a70f5d306e4fa4404f008fefe0d5ba7e05869bfffee3705.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 292
  2⤵
  - Program crash
  PID:1952