6753cb11e08d79d4ba353621080c4fe9482e88c45ac4d1c5bdea2a71e9ccece3

Analysis

max time kernel
119s
max time network
135s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 17:23

Target

6753cb11e08d79d4ba353621080c4fe9482e88c45ac4d1c5bdea2a71e9ccece3.exe
Size

8.5MB
MD5

636b958ec8eac4f7e1f390ef835c2daa
SHA1

bcef52c1719d1eca08654bbf1ae6df901a637bf4
SHA256

6753cb11e08d79d4ba353621080c4fe9482e88c45ac4d1c5bdea2a71e9ccece3
SHA512

8028629a7c2989b710fa0e4f8415db1ba5ee1593cc41c509610ca9c7cb9038fd5b745414396a4d3459f752392dbc68a99bf5e63cd1a7a094f47447a222681480
SSDEEP

98304:KbWPAyhlG4lsws6uip8J5m7xz0icRKJtcXXwfJBAUZLj:P1s6E38zLc2uXXAJVP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1300	2480	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2480	6753cb11e08d79d4ba353621080c4fe9482e88c45ac4d1c5bdea2a71e9ccece3.exe
2480	6753cb11e08d79d4ba353621080c4fe9482e88c45ac4d1c5bdea2a71e9ccece3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 1300	2480	6753cb11e08d79d4ba353621080c4fe9482e88c45ac4d1c5bdea2a71e9ccece3.exe	28
PID 2480 wrote to memory of 1300	2480	6753cb11e08d79d4ba353621080c4fe9482e88c45ac4d1c5bdea2a71e9ccece3.exe	28
PID 2480 wrote to memory of 1300	2480	6753cb11e08d79d4ba353621080c4fe9482e88c45ac4d1c5bdea2a71e9ccece3.exe	28
PID 2480 wrote to memory of 1300	2480	6753cb11e08d79d4ba353621080c4fe9482e88c45ac4d1c5bdea2a71e9ccece3.exe	28

C:\Users\Admin\AppData\Local\Temp\6753cb11e08d79d4ba353621080c4fe9482e88c45ac4d1c5bdea2a71e9ccece3.exe
"C:\Users\Admin\AppData\Local\Temp\6753cb11e08d79d4ba353621080c4fe9482e88c45ac4d1c5bdea2a71e9ccece3.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 508
  2⤵
  - Program crash
  PID:1300