e3c53cc78f5f7dc82a208a506d9d18017e6474f04f96d5dbe987945e1d815d28

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
30/09/2023, 06:26

Target

e3c53cc78f5f7dc82a208a506d9d18017e6474f04f96d5dbe987945e1d815d28.exe
Size

9.1MB
MD5

524fc93effcc0309d9a884e990fca97e
SHA1

22a878221e73bed551321a0710dd7b712598452c
SHA256

e3c53cc78f5f7dc82a208a506d9d18017e6474f04f96d5dbe987945e1d815d28
SHA512

d69b2d7975fd37cb3c6a5f12ab558a1192849176fa85fc0a2bea799a2c595939820d3254ee75e516a5be51d2134fb92299ce85faa7717a38d14ea877a4392b4b
SSDEEP

196608:WHp8GWqv226vWhlbwwm+All7v/2i70EjciUJV:wppb226Oh9ww+lD2ioEQiU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3012	2120	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2120	e3c53cc78f5f7dc82a208a506d9d18017e6474f04f96d5dbe987945e1d815d28.exe
2120	e3c53cc78f5f7dc82a208a506d9d18017e6474f04f96d5dbe987945e1d815d28.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 3012	2120	e3c53cc78f5f7dc82a208a506d9d18017e6474f04f96d5dbe987945e1d815d28.exe	28
PID 2120 wrote to memory of 3012	2120	e3c53cc78f5f7dc82a208a506d9d18017e6474f04f96d5dbe987945e1d815d28.exe	28
PID 2120 wrote to memory of 3012	2120	e3c53cc78f5f7dc82a208a506d9d18017e6474f04f96d5dbe987945e1d815d28.exe	28
PID 2120 wrote to memory of 3012	2120	e3c53cc78f5f7dc82a208a506d9d18017e6474f04f96d5dbe987945e1d815d28.exe	28

C:\Users\Admin\AppData\Local\Temp\e3c53cc78f5f7dc82a208a506d9d18017e6474f04f96d5dbe987945e1d815d28.exe
"C:\Users\Admin\AppData\Local\Temp\e3c53cc78f5f7dc82a208a506d9d18017e6474f04f96d5dbe987945e1d815d28.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 280
  2⤵
  - Program crash
  PID:3012