28a3f03175ef882efd2f09c30d3e9dc0ef697981bf7d1e6406182b29b0638c18

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:34

Target

202e21a574b8b7626b6486ed63babcc8.exe
Size

1.4MB
MD5

202e21a574b8b7626b6486ed63babcc8
SHA1

47a007c14aed21487457954787c61327408d997f
SHA256

28a3f03175ef882efd2f09c30d3e9dc0ef697981bf7d1e6406182b29b0638c18
SHA512

a9fe475bf0ff903a251a7ce71b7cd94497b4d08677189d91bca6143962afa81da86ee91067ed4e115442e5e63d81cf0caf99ea02c23af588539fe7a85701cbad
SSDEEP

24576:cwf4pwQvRHW/nSYZEnnQ3v0lJyhH2kobswtFD5i6dMHo5dsNJd1yFSt:oplvR2/SYenQcJy1GJFM6dX/6JdT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2644	2216	WerFault.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2216	202e21a574b8b7626b6486ed63babcc8.exe
2216	202e21a574b8b7626b6486ed63babcc8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2644	2216	202e21a574b8b7626b6486ed63babcc8.exe	14
PID 2216 wrote to memory of 2644	2216	202e21a574b8b7626b6486ed63babcc8.exe	14
PID 2216 wrote to memory of 2644	2216	202e21a574b8b7626b6486ed63babcc8.exe	14
PID 2216 wrote to memory of 2644	2216	202e21a574b8b7626b6486ed63babcc8.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 320
1⤵
- Program crash
PID:2644

memory/2216-0-0x0000000000400000-0x00000000007BA000-memory.dmp

Filesize
3.7MB

Download
memory/2216-4-0x0000000000400000-0x00000000007BA000-memory.dmp

Filesize
3.7MB

Download