c1846f3b665ede7c9381f58ee9307f25ce006a77454276f76e0e6432552829b1

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:56

Target

18dbe60fc9279b38b52408ed2fdead95.exe
Size

84KB
MD5

18dbe60fc9279b38b52408ed2fdead95
SHA1

c9fb76cc3b914a370bf40d1a8019bf08c93cd4fe
SHA256

c1846f3b665ede7c9381f58ee9307f25ce006a77454276f76e0e6432552829b1
SHA512

fcbbf38574009b1ab434fee9762368b637fd01d18ca07a2f32bd6e61a3ec876c226476c1b989ef35ead3ba2846d30fe2be279968e6c63faea26e634c574826b1
SSDEEP

768:Bv35BMCef+PQaEVSCBeWoLusS8dZrtzpDLbT99liMdOknCEXVOdFVXIoiLH93nCU:V5AakFmuH8d3pDfT9tdXVC8Rnxo5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2088	2496	WerFault.exe	25

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2496	18dbe60fc9279b38b52408ed2fdead95.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2088	2496	18dbe60fc9279b38b52408ed2fdead95.exe	28
PID 2496 wrote to memory of 2088	2496	18dbe60fc9279b38b52408ed2fdead95.exe	28
PID 2496 wrote to memory of 2088	2496	18dbe60fc9279b38b52408ed2fdead95.exe	28
PID 2496 wrote to memory of 2088	2496	18dbe60fc9279b38b52408ed2fdead95.exe	28

C:\Users\Admin\AppData\Local\Temp\18dbe60fc9279b38b52408ed2fdead95.exe
"C:\Users\Admin\AppData\Local\Temp\18dbe60fc9279b38b52408ed2fdead95.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 188
  2⤵
  - Program crash
  PID:2088