ed13c3f799e027636099dbd5c913ca0ed6b7e9d7847bdc3ca4e522415b18fbd1

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 08:49

Target

6125e8e239557f3152d3402208a63f15.exe
Size

52KB
MD5

6125e8e239557f3152d3402208a63f15
SHA1

acc321b8d69ff3779c19fad75d5e5c2c998b0190
SHA256

ed13c3f799e027636099dbd5c913ca0ed6b7e9d7847bdc3ca4e522415b18fbd1
SHA512

a167eff2bbc24acc781775d0b19d78895006474fad6320d3e52d0aa66dd74a712dc294b04818d9867fea249bb806f7f9d986f74871948b39c307ae3e97f44fad
SSDEEP

768:YNqCmkv1BXB8qlDp1oWLcZTzghi1OAVzcGbXebNKhVbq/h9oB:YBmkviqlDp4lMYEwrKCVe/X

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2156	1384	WerFault.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1384	6125e8e239557f3152d3402208a63f15.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 2156	1384	6125e8e239557f3152d3402208a63f15.exe	14
PID 1384 wrote to memory of 2156	1384	6125e8e239557f3152d3402208a63f15.exe	14
PID 1384 wrote to memory of 2156	1384	6125e8e239557f3152d3402208a63f15.exe	14
PID 1384 wrote to memory of 2156	1384	6125e8e239557f3152d3402208a63f15.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 188
1⤵
- Program crash
PID:2156

memory/1384-1-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1384-2-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download