6fbd65c8e0a96fa8b66b625192b9cddb74b34df05ea5e95da6910ff0a9086598

Analysis

max time kernel
121s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 15:40

Target

2a0951cfa8ca442edfb7aabed90d308c.exe
Size

156KB
MD5

2a0951cfa8ca442edfb7aabed90d308c
SHA1

6728b80ab9ca867e2e752555ce74ad8c39fb01cb
SHA256

6fbd65c8e0a96fa8b66b625192b9cddb74b34df05ea5e95da6910ff0a9086598
SHA512

8f2f4f935ac49750a70452bf9ab7dd6ba9e8fbe3ea8c2d3a944b095fb1d24c3ae0adb5c0dccc3d109ecf64fb896be3f7c9ee674da112d0da06bdd0ea945a09ff
SSDEEP

3072:mnoxLFvOpMS7yJuu4TrVlpT3rZy93E3ipMdIyH+Y8DuA2IXTa4oQZiEy7:JxnfJuu4l3rZy93UipMd9+Y8DuYaWM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1876	3044	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3044	2a0951cfa8ca442edfb7aabed90d308c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 1876	3044	2a0951cfa8ca442edfb7aabed90d308c.exe	28
PID 3044 wrote to memory of 1876	3044	2a0951cfa8ca442edfb7aabed90d308c.exe	28
PID 3044 wrote to memory of 1876	3044	2a0951cfa8ca442edfb7aabed90d308c.exe	28
PID 3044 wrote to memory of 1876	3044	2a0951cfa8ca442edfb7aabed90d308c.exe	28

C:\Users\Admin\AppData\Local\Temp\2a0951cfa8ca442edfb7aabed90d308c.exe
"C:\Users\Admin\AppData\Local\Temp\2a0951cfa8ca442edfb7aabed90d308c.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 188
  2⤵
  - Program crash
  PID:1876