9e9d501bc38604991859e69e4c6ac953f772c9e6452a0bdd38b095d3e19750b7

Analysis

max time kernel
141s
max time network
136s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 07:18

Target

9e9d501bc38604991859e69e4c6ac953f772c9e6452a0bdd38b095d3e19750b7.exe
Size

2.7MB
MD5

d9031e9f9acf126186cc830de177259b
SHA1

a00dcf8933e29bb6238c1b226b49eae74fcaa7f0
SHA256

9e9d501bc38604991859e69e4c6ac953f772c9e6452a0bdd38b095d3e19750b7
SHA512

084678df49626806d8f5f6e02e07462827d1df548fb256d95d903f427446d2a35bff5611eadd5479b289e56399d22d4404a63ce1de2e9bcde927846540fde769
SSDEEP

49152:hDqAEwAyHXUWHlbIve+z8d68bf+jKOvXqJMbrTHtv9LGttZqpBsXLIUQsf8m2qBV:hm4HXUW6vePd602va+HTHt1LAZqiIhsX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1328	1732	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1732	9e9d501bc38604991859e69e4c6ac953f772c9e6452a0bdd38b095d3e19750b7.exe
1732	9e9d501bc38604991859e69e4c6ac953f772c9e6452a0bdd38b095d3e19750b7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1328	1732	9e9d501bc38604991859e69e4c6ac953f772c9e6452a0bdd38b095d3e19750b7.exe	28
PID 1732 wrote to memory of 1328	1732	9e9d501bc38604991859e69e4c6ac953f772c9e6452a0bdd38b095d3e19750b7.exe	28
PID 1732 wrote to memory of 1328	1732	9e9d501bc38604991859e69e4c6ac953f772c9e6452a0bdd38b095d3e19750b7.exe	28
PID 1732 wrote to memory of 1328	1732	9e9d501bc38604991859e69e4c6ac953f772c9e6452a0bdd38b095d3e19750b7.exe	28

C:\Users\Admin\AppData\Local\Temp\9e9d501bc38604991859e69e4c6ac953f772c9e6452a0bdd38b095d3e19750b7.exe
"C:\Users\Admin\AppData\Local\Temp\9e9d501bc38604991859e69e4c6ac953f772c9e6452a0bdd38b095d3e19750b7.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 344
  2⤵
  - Program crash
  PID:1328

memory/1732-0-0x0000000000400000-0x0000000000A7C000-memory.dmp

Filesize
6.5MB

Download
memory/1732-1-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download
memory/1732-2-0x0000000010000000-0x0000000010059000-memory.dmp

Filesize
356KB

Download
memory/1732-3-0x00000000024B0000-0x0000000002509000-memory.dmp

Filesize
356KB

Download
memory/1732-4-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download
memory/1732-5-0x0000000000400000-0x0000000000A7C000-memory.dmp

Filesize
6.5MB

Download