a181378a78aadbb8f45250b658bb3ffe74b79847ca9426edadb6d153255f573f

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 00:33

Target

21dc4e8f701ea77a9fedf320c7f1d1b8.exe
Size

226KB
MD5

21dc4e8f701ea77a9fedf320c7f1d1b8
SHA1

9b76af00b510f7e967bb8df8d937ccb6e5b70e12
SHA256

a181378a78aadbb8f45250b658bb3ffe74b79847ca9426edadb6d153255f573f
SHA512

058cf02ab5f8fe3271a3393dfad9da5733e2141427bb63ae9816671bc119edd6e05b011d28ef86f6fea063ddb80509c7d08749f5d215fb84a9519f993590bdb3
SSDEEP

6144:IycditOjUNe6sHj1xltFUjlrFXiQSZk3GmkCCp:Iyc0QDD1DIjlxS3ZUGm9Cp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2524	2532	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2532	21dc4e8f701ea77a9fedf320c7f1d1b8.exe
2532	21dc4e8f701ea77a9fedf320c7f1d1b8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2524	2532	21dc4e8f701ea77a9fedf320c7f1d1b8.exe	28
PID 2532 wrote to memory of 2524	2532	21dc4e8f701ea77a9fedf320c7f1d1b8.exe	28
PID 2532 wrote to memory of 2524	2532	21dc4e8f701ea77a9fedf320c7f1d1b8.exe	28
PID 2532 wrote to memory of 2524	2532	21dc4e8f701ea77a9fedf320c7f1d1b8.exe	28

C:\Users\Admin\AppData\Local\Temp\21dc4e8f701ea77a9fedf320c7f1d1b8.exe
"C:\Users\Admin\AppData\Local\Temp\21dc4e8f701ea77a9fedf320c7f1d1b8.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 300
  2⤵
  - Program crash
  PID:2524

memory/2532-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2532-1-0x0000000000220000-0x0000000000258000-memory.dmp

Filesize
224KB

Download
memory/2532-2-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2532-3-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2532-4-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2532-6-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download