8a073c6dafa115cacce807b5c6574b2feddae99a1ee1018c6a2659542dd79fa0

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
25/11/2023, 19:10

Target

8a073c6dafa115cacce807b5c6574b2feddae99a1ee1018c6a2659542dd79fa0.exe
Size

2.3MB
MD5

748270d5524a0f9f97b30877ad35cd3e
SHA1

b713c4c9f73d58d368d81235cca49ebfbfdb2152
SHA256

8a073c6dafa115cacce807b5c6574b2feddae99a1ee1018c6a2659542dd79fa0
SHA512

9c28470b8911bfe02bd5c3e566d2d3cc79d90fa0e1e06025066b6d3dbbbe240a89289438b551054163169de0fb5f5c417786a7259e7143fce273394458695fbb
SSDEEP

49152:oyN4xSF4HYpkLPzjtNVpACuj0MMfArnWE1Lv/U/LZxF:oQ2SF4HYpkLLjbATqA9CLZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1940	1648	WerFault.exe	26

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1648	8a073c6dafa115cacce807b5c6574b2feddae99a1ee1018c6a2659542dd79fa0.exe
1648	8a073c6dafa115cacce807b5c6574b2feddae99a1ee1018c6a2659542dd79fa0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1940	1648	8a073c6dafa115cacce807b5c6574b2feddae99a1ee1018c6a2659542dd79fa0.exe	27
PID 1648 wrote to memory of 1940	1648	8a073c6dafa115cacce807b5c6574b2feddae99a1ee1018c6a2659542dd79fa0.exe	27
PID 1648 wrote to memory of 1940	1648	8a073c6dafa115cacce807b5c6574b2feddae99a1ee1018c6a2659542dd79fa0.exe	27
PID 1648 wrote to memory of 1940	1648	8a073c6dafa115cacce807b5c6574b2feddae99a1ee1018c6a2659542dd79fa0.exe	27

C:\Users\Admin\AppData\Local\Temp\8a073c6dafa115cacce807b5c6574b2feddae99a1ee1018c6a2659542dd79fa0.exe
"C:\Users\Admin\AppData\Local\Temp\8a073c6dafa115cacce807b5c6574b2feddae99a1ee1018c6a2659542dd79fa0.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 240
  2⤵
  - Program crash
  PID:1940