9893f929c86240dbc2e6268d9434e47e07d9cc08e485192824399aa8acf19b81

Analysis

max time kernel
154s
max time network
141s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 22:53

Target

9893f929c86240dbc2e6268d9434e47e07d9cc08e485192824399aa8acf19b81.exe
Size

5.3MB
MD5

cde1833c162e3efb4f26a05967d6158e
SHA1

4a2d7306ae92a0540fd0f841a0dccd5040aff7a5
SHA256

9893f929c86240dbc2e6268d9434e47e07d9cc08e485192824399aa8acf19b81
SHA512

f14f9a0dfde8d7a687883f380b850d2f4f83e76d21dd4c7e78730c77775eb25c01da62e0fc03f50e8e88915b0229e58577d6da8f28bf61b7b7148c7538828e7a
SSDEEP

98304:hVWTm/vWqgj7pWyDdik3OxE+kFEqiZwrBjbFdRhWFSGCSjPDWH1d:hkTpqY7pWodhFTrVRbGCSLDWVd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2260	1172	WerFault.exe	17

Suspicious use of SetWindowsHookEx 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 2260	1172	9893f929c86240dbc2e6268d9434e47e07d9cc08e485192824399aa8acf19b81.exe	28
PID 1172 wrote to memory of 2260	1172	9893f929c86240dbc2e6268d9434e47e07d9cc08e485192824399aa8acf19b81.exe	28
PID 1172 wrote to memory of 2260	1172	9893f929c86240dbc2e6268d9434e47e07d9cc08e485192824399aa8acf19b81.exe	28
PID 1172 wrote to memory of 2260	1172	9893f929c86240dbc2e6268d9434e47e07d9cc08e485192824399aa8acf19b81.exe	28

C:\Users\Admin\AppData\Local\Temp\9893f929c86240dbc2e6268d9434e47e07d9cc08e485192824399aa8acf19b81.exe
"C:\Users\Admin\AppData\Local\Temp\9893f929c86240dbc2e6268d9434e47e07d9cc08e485192824399aa8acf19b81.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 384
  2⤵
  - Program crash
  PID:2260

memory/1172-0-0x0000000000400000-0x0000000001CF7000-memory.dmp

Filesize
25.0MB

Download
memory/1172-1-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/1172-2-0x0000000000400000-0x0000000001CF7000-memory.dmp

Filesize
25.0MB

Download
memory/1172-4-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download
memory/1172-5-0x0000000000400000-0x0000000001CF7000-memory.dmp

Filesize
25.0MB

Download
memory/1172-6-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download