eafb6b661474c21efa0c6d9f16b8bdb55399778cd57e1aa71c7efbd78b6b3785

Analysis

max time kernel
149s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 04:27

Target

28224c098ed3292ad04a05b73ec4d391.exe
Size

222KB
MD5

28224c098ed3292ad04a05b73ec4d391
SHA1

e516997d04b9f55407e3ac064f30ad559bd95207
SHA256

eafb6b661474c21efa0c6d9f16b8bdb55399778cd57e1aa71c7efbd78b6b3785
SHA512

5254ec2998dfc23288c97270f4cf17c219d3e4fb01c1600158512c25b77af6f2e79f7dcbb57f39fa67d9966f362af3472d0c3bd673db081c4419075fb4b3a278
SSDEEP

6144:tB6Im3lgv4UYCTGwCwibHsa+W/foR9+lHdgUNRjUd:t8IJqwCw6sa+W/gilGUjjUd

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
468	28224c098ed3292ad04a05b73ec4d391.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msxml71.dll	28224c098ed3292ad04a05b73ec4d391.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
448	468	WerFault.exe	20

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
468	28224c098ed3292ad04a05b73ec4d391.exe

C:\Users\Admin\AppData\Local\Temp\28224c098ed3292ad04a05b73ec4d391.exe
"C:\Users\Admin\AppData\Local\Temp\28224c098ed3292ad04a05b73ec4d391.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 548
  2⤵
  - Program crash
  PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 468 -ip 468
1⤵
PID:496

memory/468-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/468-5-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download