cbf2f3d51fadc0c7ac47ed0f59f8ad3da919c7891109efc559bea86b68f3d805

Analysis

max time kernel
142s
max time network
129s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 11:20

Target

cbf2f3d51fadc0c7ac47ed0f59f8ad3da919c7891109efc559bea86b68f3d805.exe
Size

12.0MB
MD5

fb023af662cdfb67c46ac63982da8e88
SHA1

2f89486eacd0542bb87b0d8d2061373bc4a67312
SHA256

cbf2f3d51fadc0c7ac47ed0f59f8ad3da919c7891109efc559bea86b68f3d805
SHA512

e7ff625a875d35a0c4856d9f668b912fe50c76c44bf86d6d90be8f96bb8051f1319f84f27943f61973491fedb1da872a60ff7bd0bd661e351caf2ed63bb2c6e5
SSDEEP

196608:1aiYpD1k9bb2TxAhS+6A8tCMk7epL/lTE0sNoLWVkbe0D9xfERe6U9NIj1EIFckP:oiYpi9ExAIJA8thkmE0smLcQeYNw1EIL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2612	2972	WerFault.exe	27

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2972	cbf2f3d51fadc0c7ac47ed0f59f8ad3da919c7891109efc559bea86b68f3d805.exe
2972	cbf2f3d51fadc0c7ac47ed0f59f8ad3da919c7891109efc559bea86b68f3d805.exe
2972	cbf2f3d51fadc0c7ac47ed0f59f8ad3da919c7891109efc559bea86b68f3d805.exe
2972	cbf2f3d51fadc0c7ac47ed0f59f8ad3da919c7891109efc559bea86b68f3d805.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2612	2972	cbf2f3d51fadc0c7ac47ed0f59f8ad3da919c7891109efc559bea86b68f3d805.exe	28
PID 2972 wrote to memory of 2612	2972	cbf2f3d51fadc0c7ac47ed0f59f8ad3da919c7891109efc559bea86b68f3d805.exe	28
PID 2972 wrote to memory of 2612	2972	cbf2f3d51fadc0c7ac47ed0f59f8ad3da919c7891109efc559bea86b68f3d805.exe	28
PID 2972 wrote to memory of 2612	2972	cbf2f3d51fadc0c7ac47ed0f59f8ad3da919c7891109efc559bea86b68f3d805.exe	28

C:\Users\Admin\AppData\Local\Temp\cbf2f3d51fadc0c7ac47ed0f59f8ad3da919c7891109efc559bea86b68f3d805.exe
"C:\Users\Admin\AppData\Local\Temp\cbf2f3d51fadc0c7ac47ed0f59f8ad3da919c7891109efc559bea86b68f3d805.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 404
  2⤵
  - Program crash
  PID:2612

memory/2972-0-0x0000000000400000-0x0000000001DB0000-memory.dmp

Filesize
25.7MB

Download
memory/2972-1-0x0000000000250000-0x0000000000253000-memory.dmp

Filesize
12KB

Download
memory/2972-2-0x0000000000400000-0x0000000001DB0000-memory.dmp

Filesize
25.7MB

Download
memory/2972-5-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download
memory/2972-6-0x0000000000250000-0x0000000000253000-memory.dmp

Filesize
12KB

Download
memory/2972-7-0x0000000000400000-0x0000000001DB0000-memory.dmp

Filesize
25.7MB

Download