944110fcad30530c6f988e5e76c688996a8d70321a723eb8efb80eb7f3bb2f01

Analysis

max time kernel
198s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 09:53

Target

15588d322b98b93ce19804d255906392.exe
Size

250KB
MD5

15588d322b98b93ce19804d255906392
SHA1

bf8423f47e3f2244420dd61e6b582a3cc03a1154
SHA256

944110fcad30530c6f988e5e76c688996a8d70321a723eb8efb80eb7f3bb2f01
SHA512

e2f2cb04fa7f9f2ccd35facf1aa89f0357c3ec25e61b38312ef4baacc2f31fce91699dbaa61cbe5d995450e7a609519d379ce8245fe7ff5939fb1e9a4a54ddb4
SSDEEP

6144:6CeTsBgWdV/BIxx493HFEKHB+CeWufofY93:FlBgG/BIfKFTHBheWmoQl

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
4116	15588d322b98b93ce19804d255906392.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msxml71.dll	15588d322b98b93ce19804d255906392.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	4116	WerFault.exe	29

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4116	15588d322b98b93ce19804d255906392.exe

C:\Users\Admin\AppData\Local\Temp\15588d322b98b93ce19804d255906392.exe
"C:\Users\Admin\AppData\Local\Temp\15588d322b98b93ce19804d255906392.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:4116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 724
  2⤵
  - Program crash
  PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4116 -ip 4116
1⤵
PID:3960

C:\Windows\SysWOW64\msxml71.dll

Filesize
202KB

MD5
ac0d42ec1bf012da7656a64796c5275d

SHA1
a1612e707af078b67d7a0d2ca29f55b9556c904f

SHA256
b24d62f516223e6781bae66b40c48f747b32682a9a8e43b45614e92ca69fe386

SHA512
87c519108ddb89b62c70f4946b5c8e2a63f5b307797f75bbe4085cc5680474423da33b454893869bd4efd5d6e49f012b3c640e5f53c367561e1b6900fcd7477f

Download Submit
memory/4116-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4116-5-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4116-6-0x0000000010000000-0x0000000010074000-memory.dmp

Filesize
464KB

Download
memory/4116-21-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download