d38c16ae590bde483d457875fec09bac9de07c9ef6946bccd7ba4b64d2379390

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231130-en
resource tags

arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system
submitted
11/12/2023, 08:14

Target

d38c16ae590bde483d457875fec09bac9de07c9ef6946bccd7ba4b64d2379390.exe
Size

76KB
MD5

830620fcf55bce2deb9a56489b7f9d0e
SHA1

5336f76d2063d7e4462257256526f06cea372e03
SHA256

d38c16ae590bde483d457875fec09bac9de07c9ef6946bccd7ba4b64d2379390
SHA512

c2a0dbb799f26399dba0cbffd1d2fffd794c59549ed6343af29b47924e64e6738fb7c954d17010ecfb7ccbf23fa07b795e197feee1abbf51cf1e4dc727fe951d
SSDEEP

1536:bJGkZ7DMyPiYOEb7vm1ZVXD4V/dbSmZFjn8S8QwU:tGkZXrPiYx7v8HyEmZyS83U

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2220	2868	WerFault.exe	1

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2868	d38c16ae590bde483d457875fec09bac9de07c9ef6946bccd7ba4b64d2379390.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2220	2868	d38c16ae590bde483d457875fec09bac9de07c9ef6946bccd7ba4b64d2379390.exe	28
PID 2868 wrote to memory of 2220	2868	d38c16ae590bde483d457875fec09bac9de07c9ef6946bccd7ba4b64d2379390.exe	28
PID 2868 wrote to memory of 2220	2868	d38c16ae590bde483d457875fec09bac9de07c9ef6946bccd7ba4b64d2379390.exe	28
PID 2868 wrote to memory of 2220	2868	d38c16ae590bde483d457875fec09bac9de07c9ef6946bccd7ba4b64d2379390.exe	28

C:\Users\Admin\AppData\Local\Temp\d38c16ae590bde483d457875fec09bac9de07c9ef6946bccd7ba4b64d2379390.exe
"C:\Users\Admin\AppData\Local\Temp\d38c16ae590bde483d457875fec09bac9de07c9ef6946bccd7ba4b64d2379390.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 144
  2⤵
  - Program crash
  PID:2220