42f32504fe4a324830cb068a7b19fcf5d715f6830b67dd66dbafef912438df95

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:36

Target

f4370b46be57c5210c4175281f5ebdb1.exe
Size

333KB
MD5

f4370b46be57c5210c4175281f5ebdb1
SHA1

1ee90044d403ac1a353f6de99c660749c0e30947
SHA256

42f32504fe4a324830cb068a7b19fcf5d715f6830b67dd66dbafef912438df95
SHA512

2fdc4df62071cd022d84c12b9a45f9f9a7aa0be7a7315c01c625c94a784ad481efebcf0d7e9281d7db3695cba6a192ac59788b1fb9c6755ff6cc5564a5ee57e8
SSDEEP

1536:PopXMphUe8xbaEISXq/fiTvlATmeX4Z4R4H4i4/o9FKs0z2xoetEPnyexeyZiVCH:L0e89aFucz9/tBH3H3+Qp/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2752	2644	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2644	f4370b46be57c5210c4175281f5ebdb1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2752	2644	f4370b46be57c5210c4175281f5ebdb1.exe	28
PID 2644 wrote to memory of 2752	2644	f4370b46be57c5210c4175281f5ebdb1.exe	28
PID 2644 wrote to memory of 2752	2644	f4370b46be57c5210c4175281f5ebdb1.exe	28
PID 2644 wrote to memory of 2752	2644	f4370b46be57c5210c4175281f5ebdb1.exe	28

C:\Users\Admin\AppData\Local\Temp\f4370b46be57c5210c4175281f5ebdb1.exe
"C:\Users\Admin\AppData\Local\Temp\f4370b46be57c5210c4175281f5ebdb1.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 212
  2⤵
  - Program crash
  PID:2752

memory/2644-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download