46c41097a12828dfaf4b0f55e61417f76ab8824cfe9502fcfdba7265aa83e04a

Analysis

max time kernel
202s
max time network
216s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 03:11

Target

4f2e6714b75856c79cd760cce8b0e172.exe
Size

993KB
MD5

4f2e6714b75856c79cd760cce8b0e172
SHA1

8032929bd9a6cc47d37db6165a2e6874bcaa7ed6
SHA256

46c41097a12828dfaf4b0f55e61417f76ab8824cfe9502fcfdba7265aa83e04a
SHA512

7a583ee2ac3ae2437462bece93367a6c40cacd2072d5945735e720dd9f1b4c12dd84859485d699bc0a97e1a7a99120da807f1e4612de82b99527787d1b7ae906
SSDEEP

6144:ce5/c2FEDPWGc6/tSVsdwknSai1nF6L9rtSzJeL/Mo7IFD9CDgQdHhQQA1lIrv+G:SUTct

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2580	4608	WerFault.exe	87
216	4608	WerFault.exe	87

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4608	4f2e6714b75856c79cd760cce8b0e172.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 2580	4608	4f2e6714b75856c79cd760cce8b0e172.exe	97
PID 4608 wrote to memory of 2580	4608	4f2e6714b75856c79cd760cce8b0e172.exe	97
PID 4608 wrote to memory of 2580	4608	4f2e6714b75856c79cd760cce8b0e172.exe	97

C:\Users\Admin\AppData\Local\Temp\4f2e6714b75856c79cd760cce8b0e172.exe
"C:\Users\Admin\AppData\Local\Temp\4f2e6714b75856c79cd760cce8b0e172.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 480
  2⤵
  - Program crash
  PID:2580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 480
  2⤵
  - Program crash
  PID:216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4608 -ip 4608
1⤵
PID:1240

memory/4608-0-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download