414fde0a2ea556f89a9cd0217f1f13fd0df49b4eb716582f3b05d016ed5e5052

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 10:08

Target

1566bf185836127959becc50d613ff1f.exe
Size

100KB
MD5

1566bf185836127959becc50d613ff1f
SHA1

14e3ebbb78f4b49427eba361f99907893d640536
SHA256

414fde0a2ea556f89a9cd0217f1f13fd0df49b4eb716582f3b05d016ed5e5052
SHA512

a810a6254da631d4e31b2e4c7609ee4ebe80aca648c75ffe82e88b0ca7d0cffef8bb9481058a074b72ff50262f8f3d97efc3ccac92bc33d23978c8ca83796293
SSDEEP

768:nM1JEw4rTzwz76cHf/fe3cnXOwBJz76cHf/fjENFF2VCR055WJCyAaNz76cHf/f:nDw4rTzqF/Lp1F/LEHF2IK6CnapF/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2392	1704	WerFault.exe	1

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1704	1566bf185836127959becc50d613ff1f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2392	1704	1566bf185836127959becc50d613ff1f.exe	28
PID 1704 wrote to memory of 2392	1704	1566bf185836127959becc50d613ff1f.exe	28
PID 1704 wrote to memory of 2392	1704	1566bf185836127959becc50d613ff1f.exe	28
PID 1704 wrote to memory of 2392	1704	1566bf185836127959becc50d613ff1f.exe	28

C:\Users\Admin\AppData\Local\Temp\1566bf185836127959becc50d613ff1f.exe
"C:\Users\Admin\AppData\Local\Temp\1566bf185836127959becc50d613ff1f.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 188
  2⤵
  - Program crash
  PID:2392

memory/1704-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1704-2-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download