33a79bab45596814d10322226c6b2ea5219a5be7affb75cee8e1df6f45f19994

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 18:08

Target

0aa2df505742b67f798c3db8c659cb05.exe
Size

100KB
MD5

0aa2df505742b67f798c3db8c659cb05
SHA1

04f12544189c44ea35e0faf346505dc3329a474b
SHA256

33a79bab45596814d10322226c6b2ea5219a5be7affb75cee8e1df6f45f19994
SHA512

56c87190bb108c93ef96cc2969b5381a881d8f820ede9f4896ccd7b261f4e1b3aefcc4ebedc9e290e0ea9fe1726541d277a21e2849b4238e0775fed35239385a
SSDEEP

1536:vVg8iAuismyws8vLw0wF9MGM9K/oKtNgCMbA1bL3N+NM5UfONIjnZG+:y8v/KLOM5FCnQ+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1668	2116	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2116	0aa2df505742b67f798c3db8c659cb05.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 1668	2116	0aa2df505742b67f798c3db8c659cb05.exe	28
PID 2116 wrote to memory of 1668	2116	0aa2df505742b67f798c3db8c659cb05.exe	28
PID 2116 wrote to memory of 1668	2116	0aa2df505742b67f798c3db8c659cb05.exe	28
PID 2116 wrote to memory of 1668	2116	0aa2df505742b67f798c3db8c659cb05.exe	28

C:\Users\Admin\AppData\Local\Temp\0aa2df505742b67f798c3db8c659cb05.exe
"C:\Users\Admin\AppData\Local\Temp\0aa2df505742b67f798c3db8c659cb05.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 188
  2⤵
  - Program crash
  PID:1668

memory/2116-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download