52ca3df2302633d5f2ec126071a44f593e18216cc7a3742fb3076c15eb794f76

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 02:04

Target

4b576cec27cbff36768836813ec56e34.exe
Size

320KB
MD5

4b576cec27cbff36768836813ec56e34
SHA1

d5eecb9b6d23dd334b80514128af899968022917
SHA256

52ca3df2302633d5f2ec126071a44f593e18216cc7a3742fb3076c15eb794f76
SHA512

b61e105ee0bf01d18afeec8250e7e92c36f8f504959c22281dbd828a1b5bb4fbaf07f62307e9b72f040b427cd4107b2d10febbd0aecacdbc63f7af2de79c1962
SSDEEP

6144:2gIGKI//d8xgN3+E9xz3DfQr1w2O6EU02DPp9nrg5G35aJevhRGGhfZkEscw0LA1:2hg9+EDEnhtHAJevHsEscw0Lc4a

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2760	2164	WerFault.exe	1

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2164	4b576cec27cbff36768836813ec56e34.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2760	2164	4b576cec27cbff36768836813ec56e34.exe	16
PID 2164 wrote to memory of 2760	2164	4b576cec27cbff36768836813ec56e34.exe	16
PID 2164 wrote to memory of 2760	2164	4b576cec27cbff36768836813ec56e34.exe	16
PID 2164 wrote to memory of 2760	2164	4b576cec27cbff36768836813ec56e34.exe	16

C:\Users\Admin\AppData\Local\Temp\4b576cec27cbff36768836813ec56e34.exe
"C:\Users\Admin\AppData\Local\Temp\4b576cec27cbff36768836813ec56e34.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 188
  2⤵
  - Program crash
  PID:2760