841b390604b801c76f1d81a78fd1f02030fe1b834f3dc343e28d8be31fad1fc8

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 04:46

Target

841b390604b801c76f1d81a78fd1f02030fe1b834f3dc343e28d8be31fad1fc8.exe
Size

2.8MB
MD5

669abcc7cd8ce0c791cac93aac2ca212
SHA1

6deb9e77b0a015ba23f955beec0e169a3c14be6e
SHA256

841b390604b801c76f1d81a78fd1f02030fe1b834f3dc343e28d8be31fad1fc8
SHA512

b33bff04eb1e7ee1a38ed7427a9d9efffeae2fa1b8e007792edb944c262f0ebb9663c88eef325f821f8d0a4f467a64cdcbf7ecb206e47f69cfb99c781fca2d0d
SSDEEP

49152:JF7JcCVDIkS6fIXJCk8sDUHjWNmCmnn24DtM5m0oApal7A:j0hA7FDtM5loAYl7A

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2072	841b390604b801c76f1d81a78fd1f02030fe1b834f3dc343e28d8be31fad1fc8.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2644	2072	841b390604b801c76f1d81a78fd1f02030fe1b834f3dc343e28d8be31fad1fc8.exe	28
PID 2072 wrote to memory of 2644	2072	841b390604b801c76f1d81a78fd1f02030fe1b834f3dc343e28d8be31fad1fc8.exe	28
PID 2072 wrote to memory of 2644	2072	841b390604b801c76f1d81a78fd1f02030fe1b834f3dc343e28d8be31fad1fc8.exe	28

C:\Users\Admin\AppData\Local\Temp\841b390604b801c76f1d81a78fd1f02030fe1b834f3dc343e28d8be31fad1fc8.exe
"C:\Users\Admin\AppData\Local\Temp\841b390604b801c76f1d81a78fd1f02030fe1b834f3dc343e28d8be31fad1fc8.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2072 -s 232
  2⤵
  PID:2644

memory/2072-0-0x0000000077530000-0x00000000776D9000-memory.dmp

Filesize
1.7MB

Download