74d476dd0187ef683db1ef4f7fa8e9a8f89ba4b0615e67716aa166b26dcf2973

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 23:22

Target

192eea1307803f4a91f42826067f91a8.exe
Size

68KB
MD5

192eea1307803f4a91f42826067f91a8
SHA1

004c0cd841564eb7c1bf4fc8cac617501c9a37f6
SHA256

74d476dd0187ef683db1ef4f7fa8e9a8f89ba4b0615e67716aa166b26dcf2973
SHA512

5ac59dfff3a5cac7049a6cfffc521291e1cbaf4e1c4ac6073ec068a4affb807b0d8bb73635312ef8bcbc8074816d4b23e6fccbcff679768b6650e754b1d5b1c7
SSDEEP

768:VBk+chnndZQefxpeMwd1Jg5Yolbihi8x1A73mHqXUCTR+jrja3:Pk+c1ndZQefYlg5/ti2uPa3

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2904 set thread context of 2524	2904	192eea1307803f4a91f42826067f91a8.exe	14

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2308	2904	WerFault.exe	15

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2904	192eea1307803f4a91f42826067f91a8.exe
2524	192eea1307803f4a91f42826067f91a8.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2524	2904	192eea1307803f4a91f42826067f91a8.exe	14
PID 2904 wrote to memory of 2524	2904	192eea1307803f4a91f42826067f91a8.exe	14
PID 2904 wrote to memory of 2524	2904	192eea1307803f4a91f42826067f91a8.exe	14
PID 2904 wrote to memory of 2524	2904	192eea1307803f4a91f42826067f91a8.exe	14
PID 2904 wrote to memory of 2524	2904	192eea1307803f4a91f42826067f91a8.exe	14
PID 2904 wrote to memory of 2524	2904	192eea1307803f4a91f42826067f91a8.exe	14
PID 2904 wrote to memory of 2524	2904	192eea1307803f4a91f42826067f91a8.exe	14
PID 2904 wrote to memory of 2524	2904	192eea1307803f4a91f42826067f91a8.exe	14
PID 2904 wrote to memory of 2524	2904	192eea1307803f4a91f42826067f91a8.exe	14
PID 2904 wrote to memory of 2308	2904	192eea1307803f4a91f42826067f91a8.exe	16
PID 2904 wrote to memory of 2308	2904	192eea1307803f4a91f42826067f91a8.exe	16
PID 2904 wrote to memory of 2308	2904	192eea1307803f4a91f42826067f91a8.exe	16
PID 2904 wrote to memory of 2308	2904	192eea1307803f4a91f42826067f91a8.exe	16

C:\Users\Admin\AppData\Local\Temp\192eea1307803f4a91f42826067f91a8.exe
1⤵
- Suspicious use of SetWindowsHookEx
PID:2524

C:\Users\Admin\AppData\Local\Temp\192eea1307803f4a91f42826067f91a8.exe
"C:\Users\Admin\AppData\Local\Temp\192eea1307803f4a91f42826067f91a8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 192
  2⤵
  - Program crash
  PID:2308

memory/2524-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2524-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2524-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download