4323fef9a9656f075626f778d888f163ae08ea206a1df6a1260b71dd11b4ccbf

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:21

Target

0e484b716b590c8833647656b0bef34e.exe
Size

288KB
MD5

0e484b716b590c8833647656b0bef34e
SHA1

ce854a1bcbf1157ed7632da2716701afa079a2a0
SHA256

4323fef9a9656f075626f778d888f163ae08ea206a1df6a1260b71dd11b4ccbf
SHA512

c6c0f3dcce96029ceba7f2d1271fd1218fa135d67f509cfffef55c431ee164bb2fe627db151706d7d6f673f06f02dadb042210e36a89da5bc9742b249bd7705b
SSDEEP

6144:Pv9xpc0f7XP+g3AGJpWVzuNmI8nQOsPVKnvmb7/D26Mbj/R8SUHAg8JxgTTMEtBs:H627/XvLWpuAnQOsPVKnvmb7/D26MHUc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1692	2736	WerFault.exe	1

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2736	0e484b716b590c8833647656b0bef34e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 1692	2736	0e484b716b590c8833647656b0bef34e.exe	28
PID 2736 wrote to memory of 1692	2736	0e484b716b590c8833647656b0bef34e.exe	28
PID 2736 wrote to memory of 1692	2736	0e484b716b590c8833647656b0bef34e.exe	28
PID 2736 wrote to memory of 1692	2736	0e484b716b590c8833647656b0bef34e.exe	28

C:\Users\Admin\AppData\Local\Temp\0e484b716b590c8833647656b0bef34e.exe
"C:\Users\Admin\AppData\Local\Temp\0e484b716b590c8833647656b0bef34e.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 188
  2⤵
  - Program crash
  PID:1692