ab970207040e63fbfb4743966f3dbe6843140f4cba6d1cc0bc7c1af337b5d364

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:31

Target

1e882b5ac4fceedf0f50dad2b0380bb6.exe
Size

156KB
MD5

1e882b5ac4fceedf0f50dad2b0380bb6
SHA1

5f1cce3a19702d8b7e4799493cab7f08696fe28d
SHA256

ab970207040e63fbfb4743966f3dbe6843140f4cba6d1cc0bc7c1af337b5d364
SHA512

404f20cf2867eaef135c795b63ebe11c5ee36390fceca45fd7cdd8880f1d3ce68f4ccb7e1df9441b4fc842670f3e6bf32c3b47b720cf683cc0bbc293d34ffe23
SSDEEP

3072:A8VmtOK9IOJeC+3Ip4CFbgjZnJygNqHVbwvVTSIs04oQZiEMp:1VmQK9psIp44bgjZzwVoT2QWo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1304	1796	WerFault.exe	14

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1796	1e882b5ac4fceedf0f50dad2b0380bb6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 1304	1796	1e882b5ac4fceedf0f50dad2b0380bb6.exe	24
PID 1796 wrote to memory of 1304	1796	1e882b5ac4fceedf0f50dad2b0380bb6.exe	24
PID 1796 wrote to memory of 1304	1796	1e882b5ac4fceedf0f50dad2b0380bb6.exe	24
PID 1796 wrote to memory of 1304	1796	1e882b5ac4fceedf0f50dad2b0380bb6.exe	24

C:\Users\Admin\AppData\Local\Temp\1e882b5ac4fceedf0f50dad2b0380bb6.exe
"C:\Users\Admin\AppData\Local\Temp\1e882b5ac4fceedf0f50dad2b0380bb6.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 188
  2⤵
  - Program crash
  PID:1304