e2f487f54b21bbe6401a4f3378c8cf9e565f4ee13e598d59127f27a14f2c6ffc

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 22:47

Target

1eed05c78e2721b06a1158a3d7d54077.exe
Size

228KB
MD5

1eed05c78e2721b06a1158a3d7d54077
SHA1

c3d87e3a229eb0d02f2de0b768fb4850ecbb24af
SHA256

e2f487f54b21bbe6401a4f3378c8cf9e565f4ee13e598d59127f27a14f2c6ffc
SHA512

04b35754c98931dd4876278101d11b9cd8fc54c1f6639a337f8eb5f143fd33ab84fdad7b89feec92e50142ae311e2958dbb541cd9c88fdc290133fd56b00c3b5
SSDEEP

3072:L1ZfUu1nCKHONRdps0yupQ8+QUjkW89zaelC1CtklJ9rvYAdxUpjwdAbcOY1jt+z:ZZfUknC3RdpsBENklJ9rvVXUYAbcpw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1236	2476	WerFault.exe	14

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2476	1eed05c78e2721b06a1158a3d7d54077.exe
2476	1eed05c78e2721b06a1158a3d7d54077.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 1236	2476	1eed05c78e2721b06a1158a3d7d54077.exe	28
PID 2476 wrote to memory of 1236	2476	1eed05c78e2721b06a1158a3d7d54077.exe	28
PID 2476 wrote to memory of 1236	2476	1eed05c78e2721b06a1158a3d7d54077.exe	28
PID 2476 wrote to memory of 1236	2476	1eed05c78e2721b06a1158a3d7d54077.exe	28

C:\Users\Admin\AppData\Local\Temp\1eed05c78e2721b06a1158a3d7d54077.exe
"C:\Users\Admin\AppData\Local\Temp\1eed05c78e2721b06a1158a3d7d54077.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 300
  2⤵
  - Program crash
  PID:1236

memory/2476-0-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2476-1-0x0000000000220000-0x0000000000258000-memory.dmp

Filesize
224KB

Download
memory/2476-2-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2476-3-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2476-4-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2476-6-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download