ba344e7041cc276706c894924d77216effef9ccad4c4d088991ae349fcfe426a

Analysis

max time kernel
142s
max time network
123s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
23/11/2023, 19:10

Target

ba344e7041cc276706c894924d77216effef9ccad4c4d088991ae349fcfe426a.exe
Size

2.5MB
MD5

83a67f5a337ee1a5afd1a83e0dbbcc94
SHA1

9a33855cd92821f486dc31d519840a6132254f5b
SHA256

ba344e7041cc276706c894924d77216effef9ccad4c4d088991ae349fcfe426a
SHA512

a6dcd2283a6b70e9aa63284ba6e675140be2114e7e12ff53800bd5c151a00afc9169afb118ebc530ec44a90a445ab05a0ab895622aabafd8ebe510b6096bb866
SSDEEP

49152:P7ChlnmPh1d6CTZEbI/XAUlkn/kiwIZnxUgIie9EWkQ2mHxyQ+bZ:WhxUz6CVlwUSnciw8xde9E1PmB+bZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2016	2580	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2580	ba344e7041cc276706c894924d77216effef9ccad4c4d088991ae349fcfe426a.exe
2580	ba344e7041cc276706c894924d77216effef9ccad4c4d088991ae349fcfe426a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2016	2580	ba344e7041cc276706c894924d77216effef9ccad4c4d088991ae349fcfe426a.exe	28
PID 2580 wrote to memory of 2016	2580	ba344e7041cc276706c894924d77216effef9ccad4c4d088991ae349fcfe426a.exe	28
PID 2580 wrote to memory of 2016	2580	ba344e7041cc276706c894924d77216effef9ccad4c4d088991ae349fcfe426a.exe	28
PID 2580 wrote to memory of 2016	2580	ba344e7041cc276706c894924d77216effef9ccad4c4d088991ae349fcfe426a.exe	28

C:\Users\Admin\AppData\Local\Temp\ba344e7041cc276706c894924d77216effef9ccad4c4d088991ae349fcfe426a.exe
"C:\Users\Admin\AppData\Local\Temp\ba344e7041cc276706c894924d77216effef9ccad4c4d088991ae349fcfe426a.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 340
  2⤵
  - Program crash
  PID:2016

memory/2580-0-0x0000000000400000-0x0000000000A97000-memory.dmp

Filesize
6.6MB

Download
memory/2580-1-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2580-2-0x0000000010000000-0x0000000010059000-memory.dmp

Filesize
356KB

Download
memory/2580-3-0x0000000000390000-0x00000000003E9000-memory.dmp

Filesize
356KB

Download
memory/2580-4-0x0000000000400000-0x0000000000A97000-memory.dmp

Filesize
6.6MB

Download