62ae869b6278112e2a03b2dc706485ee19654be992c88a01d33d94db6c802956

Analysis

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 14:43

Target

62ae869b6278112e2a03b2dc706485ee19654be992c88a01d33d94db6c802956.exe
Size

1.3MB
MD5

9d8e327c7cd393b3acfaefb007b6bf49
SHA1

3c8a87de0eea198e9f1c7c7173525b716f9f118f
SHA256

62ae869b6278112e2a03b2dc706485ee19654be992c88a01d33d94db6c802956
SHA512

7edad7f8e7044c366ece2fa4ba2b8ac72c8863c33f14f2271f54b533c8dbf39286f74107bc01cb7be109148b2d6364c1c6327b76869bcace5c5d663d6c6201a6
SSDEEP

24576:w3bFHQjdrdZSaUsgdmNsKO//UTSplV/7EEAsKO//UTSplV/7EETDmuiUUWPawnN:w3bFwjdxLUhE1O//UTSplV/7EEA1O//n

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2660	1872	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1872	62ae869b6278112e2a03b2dc706485ee19654be992c88a01d33d94db6c802956.exe
1872	62ae869b6278112e2a03b2dc706485ee19654be992c88a01d33d94db6c802956.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2660	1872	62ae869b6278112e2a03b2dc706485ee19654be992c88a01d33d94db6c802956.exe	31
PID 1872 wrote to memory of 2660	1872	62ae869b6278112e2a03b2dc706485ee19654be992c88a01d33d94db6c802956.exe	31
PID 1872 wrote to memory of 2660	1872	62ae869b6278112e2a03b2dc706485ee19654be992c88a01d33d94db6c802956.exe	31
PID 1872 wrote to memory of 2660	1872	62ae869b6278112e2a03b2dc706485ee19654be992c88a01d33d94db6c802956.exe	31

C:\Users\Admin\AppData\Local\Temp\62ae869b6278112e2a03b2dc706485ee19654be992c88a01d33d94db6c802956.exe
"C:\Users\Admin\AppData\Local\Temp\62ae869b6278112e2a03b2dc706485ee19654be992c88a01d33d94db6c802956.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 832
  2⤵
  - Program crash
  PID:2660

memory/1872-0-0x0000000000400000-0x000000000058D000-memory.dmp

Filesize
1.6MB

Download
memory/1872-1-0x0000000000400000-0x000000000058D000-memory.dmp

Filesize
1.6MB

Download
memory/1872-2-0x0000000000400000-0x000000000058D000-memory.dmp

Filesize
1.6MB

Download
memory/1872-3-0x0000000000400000-0x000000000058D000-memory.dmp

Filesize
1.6MB

Download
memory/1872-4-0x0000000000400000-0x000000000058D000-memory.dmp

Filesize
1.6MB

Download
memory/1872-8-0x0000000000400000-0x000000000058D000-memory.dmp

Filesize
1.6MB

Download