92310654aa96b61f636665e0fb2112adf1af2a96d88b5b9ea84569eb05797291

Analysis

max time kernel
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 07:06

Target

11bbbaf12ac77e5140d045441d2c69bf.exe
Size

125KB
MD5

11bbbaf12ac77e5140d045441d2c69bf
SHA1

bb028d3068f6e36bb4ed5f5f7d09d904172361c8
SHA256

92310654aa96b61f636665e0fb2112adf1af2a96d88b5b9ea84569eb05797291
SHA512

e496e1968fe8c209ec81c4b257b74d532b518b1daf48c4b0336c8adca80b344114d74c037d35412af13592482c77d4656d104cc111a4463e0342be9bcc0e9504
SSDEEP

3072:LnJ26uk5gqsXb9bpLjQTZEON+awfMbwbNddf7wHx7hzDTXXwsSt:LnU6R5ebpksfMcDN7I7tvnwsS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4968	1084	WerFault.exe	16

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings	calc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3520	OpenWith.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 3440	1084	11bbbaf12ac77e5140d045441d2c69bf.exe	19
PID 1084 wrote to memory of 3440	1084	11bbbaf12ac77e5140d045441d2c69bf.exe	19
PID 1084 wrote to memory of 3440	1084	11bbbaf12ac77e5140d045441d2c69bf.exe	19

C:\Users\Admin\AppData\Local\Temp\11bbbaf12ac77e5140d045441d2c69bf.exe
"C:\Users\Admin\AppData\Local\Temp\11bbbaf12ac77e5140d045441d2c69bf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\calc.exe
  calc
  2⤵
  - Modifies registry class
  PID:3440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 212
  2⤵
  - Program crash
  PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1084 -ip 1084
1⤵
PID:2736

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3520

memory/1084-0-0x0000000000D20000-0x0000000000D30000-memory.dmp

Filesize
64KB

Download