08c090da59a963e2ad49fc76b53e1ae14c45e171d03b714ef7329ce871da4fb1

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 23:23

Target

ffaafd2199dc08994ec7a76d5fc254ab.exe
Size

176KB
MD5

ffaafd2199dc08994ec7a76d5fc254ab
SHA1

ddc149ef1f8ce8b87eba435c162d7dafc3c3c1e9
SHA256

08c090da59a963e2ad49fc76b53e1ae14c45e171d03b714ef7329ce871da4fb1
SHA512

1671a54112472f67232a7f805f9e5774da975f7cca2f4829a59074e52eae69250e5b8e041d712eda9cb298be4650f3e3ea6fdfcc81cef09dca78f7870bd6a5f9
SSDEEP

3072:/zBuKNB57EoiO8S9aCWKnvmb7/D26BXbBD8R4FpjIyc4j+a/dLfED0Co0beLtzR5:/zBXfBQKnvmb7/D26BLBD8R4FpjIyc4x

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1988	2440	WerFault.exe	11

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2440	ffaafd2199dc08994ec7a76d5fc254ab.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 1988	2440	ffaafd2199dc08994ec7a76d5fc254ab.exe	16
PID 2440 wrote to memory of 1988	2440	ffaafd2199dc08994ec7a76d5fc254ab.exe	16
PID 2440 wrote to memory of 1988	2440	ffaafd2199dc08994ec7a76d5fc254ab.exe	16
PID 2440 wrote to memory of 1988	2440	ffaafd2199dc08994ec7a76d5fc254ab.exe	16

C:\Users\Admin\AppData\Local\Temp\ffaafd2199dc08994ec7a76d5fc254ab.exe
"C:\Users\Admin\AppData\Local\Temp\ffaafd2199dc08994ec7a76d5fc254ab.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 188
  2⤵
  - Program crash
  PID:1988