50f78f40dfaad3efdd0209338df6bd301629cc990657a89911dac2a36e6b3373

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 13:54 UTC

Target

2363216eef39c5afa0519f99de711ce7.exe
Size

160KB
MD5

2363216eef39c5afa0519f99de711ce7
SHA1

a3e71bf53041d650fb35163bba3ab3cbaec1f88f
SHA256

50f78f40dfaad3efdd0209338df6bd301629cc990657a89911dac2a36e6b3373
SHA512

1662bcfb368a9d2a6780661c1bc8ef56a6ef47821702e35e218f78440c1ad684874cdbcb91f5828180d06141d868590597dc7f8529fd4f727bd5a2888aa2c096
SSDEEP

3072:Bh7xJptfKqOdBsebgeDyJiqmdoTtawZPotUPvPDspYxjatL0JiTeDXokR49M6evG:v7DptfKRLsebgeDyJtmdo7PIWDspYJa5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	1888	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1888	2363216eef39c5afa0519f99de711ce7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 1708	1888	2363216eef39c5afa0519f99de711ce7.exe	28
PID 1888 wrote to memory of 1708	1888	2363216eef39c5afa0519f99de711ce7.exe	28
PID 1888 wrote to memory of 1708	1888	2363216eef39c5afa0519f99de711ce7.exe	28
PID 1888 wrote to memory of 1708	1888	2363216eef39c5afa0519f99de711ce7.exe	28

C:\Users\Admin\AppData\Local\Temp\2363216eef39c5afa0519f99de711ce7.exe
"C:\Users\Admin\AppData\Local\Temp\2363216eef39c5afa0519f99de711ce7.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 188
  2⤵
  - Program crash
  PID:1708