96110887a025dac9aa51504feab1156f4834d3bda9fb9e525df0f9f0e3fa5e3b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:00

Target

e4e8560633699b6bd4b0d55390b1d6dc.exe
Size

246KB
MD5

e4e8560633699b6bd4b0d55390b1d6dc
SHA1

d7b78f1f9b9bf1fa812dfa58e5427207f9c77fad
SHA256

96110887a025dac9aa51504feab1156f4834d3bda9fb9e525df0f9f0e3fa5e3b
SHA512

4331fbd31914c772b7b11bf73d13d4edbb535de07a7e4b3b152552c309c85c8d1ecbb2ef3e989681a54d8ccd37d442b66685e7cd98fea111d13efffc2317aa19
SSDEEP

768:1lvMaLNJiK7EHZOS1NiIuwbjMPkG1VuW/wqvRXMXp677yCzdXZRT2Nq1MaQnepMS:1RlJJi3H0S1NZHlGVs4emEFbsP0r0h

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2208	628	WerFault.exe	7

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
628	e4e8560633699b6bd4b0d55390b1d6dc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 2208	628	e4e8560633699b6bd4b0d55390b1d6dc.exe	21
PID 628 wrote to memory of 2208	628	e4e8560633699b6bd4b0d55390b1d6dc.exe	21
PID 628 wrote to memory of 2208	628	e4e8560633699b6bd4b0d55390b1d6dc.exe	21
PID 628 wrote to memory of 2208	628	e4e8560633699b6bd4b0d55390b1d6dc.exe	21

C:\Users\Admin\AppData\Local\Temp\e4e8560633699b6bd4b0d55390b1d6dc.exe
"C:\Users\Admin\AppData\Local\Temp\e4e8560633699b6bd4b0d55390b1d6dc.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 212
  2⤵
  - Program crash
  PID:2208

memory/628-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download