463efe2984bfb642643666d63fe7233cd97c0ae9b53881f535d36adc90d5a30d

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
24-11-2023 17:59

Target

463efe2984bfb642643666d63fe7233cd97c0ae9b53881f535d36adc90d5a30d.exe
Size

3.7MB
MD5

774afbd004e5f9939d96715b1572e0e9
SHA1

04bf851e1ea9fdeff016a4ee38b47c796deea2d2
SHA256

463efe2984bfb642643666d63fe7233cd97c0ae9b53881f535d36adc90d5a30d
SHA512

599d50f0e0166291412ac263926e9d2c6a9a20ea863071e93e511457cfef66743ea336656ae0c852fa5a26bde9fa0683134161ac4c9781bbd23c3c9b4b38041a
SSDEEP

98304:18XfqNc+Wq0BJcGFbpNkvazaZ3F5U2t8AVTBnFT/4j+wVqKlAgQiuM+s6SwKYe:oFbpNkvazaZ3F5U2t8AVTBFTbOqKtz5v

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2068	2988	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2988	463efe2984bfb642643666d63fe7233cd97c0ae9b53881f535d36adc90d5a30d.exe
2988	463efe2984bfb642643666d63fe7233cd97c0ae9b53881f535d36adc90d5a30d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2068	2988	463efe2984bfb642643666d63fe7233cd97c0ae9b53881f535d36adc90d5a30d.exe	28
PID 2988 wrote to memory of 2068	2988	463efe2984bfb642643666d63fe7233cd97c0ae9b53881f535d36adc90d5a30d.exe	28
PID 2988 wrote to memory of 2068	2988	463efe2984bfb642643666d63fe7233cd97c0ae9b53881f535d36adc90d5a30d.exe	28
PID 2988 wrote to memory of 2068	2988	463efe2984bfb642643666d63fe7233cd97c0ae9b53881f535d36adc90d5a30d.exe	28

C:\Users\Admin\AppData\Local\Temp\463efe2984bfb642643666d63fe7233cd97c0ae9b53881f535d36adc90d5a30d.exe
"C:\Users\Admin\AppData\Local\Temp\463efe2984bfb642643666d63fe7233cd97c0ae9b53881f535d36adc90d5a30d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 360
  2⤵
  - Program crash
  PID:2068