66466081333b4eb700d24c04c3d08491b333640e147b22f4db9fabc9ab3dcbb5

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 11:10

Target

66466081333b4eb700d24c04c3d08491b333640e147b22f4db9fabc9ab3dcbb5.exe
Size

3.3MB
MD5

10438b1b659957c39e0ce2d4dd03a7b9
SHA1

4c08f8ae3b77e3246201a1134706dee00f298747
SHA256

66466081333b4eb700d24c04c3d08491b333640e147b22f4db9fabc9ab3dcbb5
SHA512

a0b004207b82ae0ff68a03fd823f199eda496fa0ca7e4d234e3ee00c0eb1e032441ffa72a15a34d6607a1ef9596bc1e4f06688bd795bf108b260baec65a735f2
SSDEEP

98304:UlITQ6jhmFEA1CcDBWzcdEK3teVV0RHe909ERY9k4OiZrq1DfPHNADtV6v+m:uZFp1C2EK3teE9ERY9k4O7NADtV6v+m

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2804	1812	WerFault.exe	14

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1812	66466081333b4eb700d24c04c3d08491b333640e147b22f4db9fabc9ab3dcbb5.exe
1812	66466081333b4eb700d24c04c3d08491b333640e147b22f4db9fabc9ab3dcbb5.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2804	1812	66466081333b4eb700d24c04c3d08491b333640e147b22f4db9fabc9ab3dcbb5.exe	29
PID 1812 wrote to memory of 2804	1812	66466081333b4eb700d24c04c3d08491b333640e147b22f4db9fabc9ab3dcbb5.exe	29
PID 1812 wrote to memory of 2804	1812	66466081333b4eb700d24c04c3d08491b333640e147b22f4db9fabc9ab3dcbb5.exe	29
PID 1812 wrote to memory of 2804	1812	66466081333b4eb700d24c04c3d08491b333640e147b22f4db9fabc9ab3dcbb5.exe	29

C:\Users\Admin\AppData\Local\Temp\66466081333b4eb700d24c04c3d08491b333640e147b22f4db9fabc9ab3dcbb5.exe
"C:\Users\Admin\AppData\Local\Temp\66466081333b4eb700d24c04c3d08491b333640e147b22f4db9fabc9ab3dcbb5.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 328
  2⤵
  - Program crash
  PID:2804