ef749f29c3c58369779fb3512db67abb79aaee3ba57aea91ebf962e6dd8bdb31

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
22/11/2023, 11:10

Target

ef749f29c3c58369779fb3512db67abb79aaee3ba57aea91ebf962e6dd8bdb31.exe
Size

645KB
MD5

691cf2075747eda7e5862fd250e8d143
SHA1

aec4622064c9c0ad0bd74221b996ffea68d6096a
SHA256

ef749f29c3c58369779fb3512db67abb79aaee3ba57aea91ebf962e6dd8bdb31
SHA512

c946f7acb7136316292b5edc40495611c050ff881099d1ac90f612dd283cd800438b1274d40152181e32c188e57c9a3f09bf517a3b12c74ac41d7402013817d2
SSDEEP

6144:+HYH16ziDe6w49gMNKNQdifAIt1RitoXc4NaskpNPSoOfbs5X5aIsGXvrYjcBqQ:8U6/6wagYItjXNwXsK/qQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2176	2244	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2244	ef749f29c3c58369779fb3512db67abb79aaee3ba57aea91ebf962e6dd8bdb31.exe
2244	ef749f29c3c58369779fb3512db67abb79aaee3ba57aea91ebf962e6dd8bdb31.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2176	2244	ef749f29c3c58369779fb3512db67abb79aaee3ba57aea91ebf962e6dd8bdb31.exe	29
PID 2244 wrote to memory of 2176	2244	ef749f29c3c58369779fb3512db67abb79aaee3ba57aea91ebf962e6dd8bdb31.exe	29
PID 2244 wrote to memory of 2176	2244	ef749f29c3c58369779fb3512db67abb79aaee3ba57aea91ebf962e6dd8bdb31.exe	29
PID 2244 wrote to memory of 2176	2244	ef749f29c3c58369779fb3512db67abb79aaee3ba57aea91ebf962e6dd8bdb31.exe	29

C:\Users\Admin\AppData\Local\Temp\ef749f29c3c58369779fb3512db67abb79aaee3ba57aea91ebf962e6dd8bdb31.exe
"C:\Users\Admin\AppData\Local\Temp\ef749f29c3c58369779fb3512db67abb79aaee3ba57aea91ebf962e6dd8bdb31.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 796
  2⤵
  - Program crash
  PID:2176

memory/2244-0-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/2244-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2244-2-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/2244-4-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/2244-5-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download