ec5595e12df935e6a75bd0498bf997121a341c16f3d943b2b145d19bc733bffb

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 23:27

Target

ec5595e12df935e6a75bd0498bf997121a341c16f3d943b2b145d19bc733bffb.exe
Size

2.6MB
MD5

f3a9ab9b3fcb55ce313d719ed3295a5c
SHA1

d1036316c154a003b84ee8ffaf4a2a53ce4ff7d1
SHA256

ec5595e12df935e6a75bd0498bf997121a341c16f3d943b2b145d19bc733bffb
SHA512

e8746e288b51cb1dfd72aed8f3231c416bda904d81edfae80a97c5644b2a2a760c3923835016bc522100b718b478042f1f16ac209b7fc248503daabda426b1f4
SSDEEP

49152:Tt6bTX/7bKtOiDZj3Ff+s8KuqGaX0ToIBAUZLY:qT7buDZCJBAUZL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2268	2324	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2324	ec5595e12df935e6a75bd0498bf997121a341c16f3d943b2b145d19bc733bffb.exe
2324	ec5595e12df935e6a75bd0498bf997121a341c16f3d943b2b145d19bc733bffb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2268	2324	ec5595e12df935e6a75bd0498bf997121a341c16f3d943b2b145d19bc733bffb.exe	29
PID 2324 wrote to memory of 2268	2324	ec5595e12df935e6a75bd0498bf997121a341c16f3d943b2b145d19bc733bffb.exe	29
PID 2324 wrote to memory of 2268	2324	ec5595e12df935e6a75bd0498bf997121a341c16f3d943b2b145d19bc733bffb.exe	29
PID 2324 wrote to memory of 2268	2324	ec5595e12df935e6a75bd0498bf997121a341c16f3d943b2b145d19bc733bffb.exe	29

C:\Users\Admin\AppData\Local\Temp\ec5595e12df935e6a75bd0498bf997121a341c16f3d943b2b145d19bc733bffb.exe
"C:\Users\Admin\AppData\Local\Temp\ec5595e12df935e6a75bd0498bf997121a341c16f3d943b2b145d19bc733bffb.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 276
  2⤵
  - Program crash
  PID:2268