98cc5310a1409773cadcdbd099d336a08aead69b9a6ae06cc29d1a09c54d50d8

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 23:29

Target

ffef8cc4276dd0bb188d3c5774d358a3.exe
Size

172KB
MD5

ffef8cc4276dd0bb188d3c5774d358a3
SHA1

37777fb73a2790bf5e3fa23606d3fcab734e1031
SHA256

98cc5310a1409773cadcdbd099d336a08aead69b9a6ae06cc29d1a09c54d50d8
SHA512

bde21b8f4175670a5ddb3a6c5e3112a45fe1daad2377ea175eeeee1d33dedca4743a38b1b39bd3dcfea39b46f267a6a993e57ae2d93eee187e22d14564f0abc5
SSDEEP

3072:q3DoorL3bo999kC0RKPw4RKCmWLNOxuJwH3G7t3vwUhp4/BDR:q30oL29SRYw4RKjSKGwe3hCDR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2532	2896	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2896	ffef8cc4276dd0bb188d3c5774d358a3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2532	2896	ffef8cc4276dd0bb188d3c5774d358a3.exe	28
PID 2896 wrote to memory of 2532	2896	ffef8cc4276dd0bb188d3c5774d358a3.exe	28
PID 2896 wrote to memory of 2532	2896	ffef8cc4276dd0bb188d3c5774d358a3.exe	28
PID 2896 wrote to memory of 2532	2896	ffef8cc4276dd0bb188d3c5774d358a3.exe	28

C:\Users\Admin\AppData\Local\Temp\ffef8cc4276dd0bb188d3c5774d358a3.exe
"C:\Users\Admin\AppData\Local\Temp\ffef8cc4276dd0bb188d3c5774d358a3.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 188
  2⤵
  - Program crash
  PID:2532