3a38a660d09de235a47ff68f0740d5aeef9df19d4c730abec1f3f45b1817dcb7

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
20/11/2023, 16:08

Target

SuperQr.exe
Size

403KB
MD5

1b4b2826575bf121735a952c8ffbe873
SHA1

62dd9b118e0cda3d52d2fc458ae63a5ece43f2d0
SHA256

012dfb97fb33e901cd60d388d2daa4e258456191ec5cdc1470a1fd54e85473c6
SHA512

4ff1e11adc1eaedaf5076d9c9e06db4e7394de58e98dfc69e8e68817a2f7327945cf92d9f728722f97a0c406459f412b054b94c89e22975e261cc5f9311dae85
SSDEEP

6144:/OFdF9wzsrPkmRBMUZ7YuhXFVcy6aTqNbl:GjesrPkmEUnhXFVbo

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1164	SuperQr.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 2312	1164	SuperQr.exe	28
PID 1164 wrote to memory of 2312	1164	SuperQr.exe	28
PID 1164 wrote to memory of 2312	1164	SuperQr.exe	28

C:\Users\Admin\AppData\Local\Temp\SuperQr.exe
"C:\Users\Admin\AppData\Local\Temp\SuperQr.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1164 -s 1060
  2⤵
  PID:2312

memory/1164-0-0x00000000011F0000-0x000000000125A000-memory.dmp

Filesize
424KB

Download
memory/1164-1-0x000007FEF5A00000-0x000007FEF63EC000-memory.dmp

Filesize
9.9MB

Download
memory/1164-2-0x000000001B3E0000-0x000000001B460000-memory.dmp

Filesize
512KB

Download
memory/1164-3-0x0000000000410000-0x0000000000452000-memory.dmp

Filesize
264KB

Download
memory/1164-4-0x00000000004C0000-0x00000000004FE000-memory.dmp

Filesize
248KB

Download
memory/1164-5-0x000000001B3E0000-0x000000001B460000-memory.dmp

Filesize
512KB

Download
memory/1164-6-0x000000001C510000-0x000000001C54A000-memory.dmp

Filesize
232KB

Download
memory/1164-7-0x000000001B3E0000-0x000000001B460000-memory.dmp

Filesize
512KB

Download
memory/1164-8-0x000007FEF5A00000-0x000007FEF63EC000-memory.dmp

Filesize
9.9MB

Download
memory/1164-9-0x000000001B3E0000-0x000000001B460000-memory.dmp

Filesize
512KB

Download
memory/1164-10-0x000000001B3E0000-0x000000001B460000-memory.dmp

Filesize
512KB

Download