120543b1b93d090459cde3504cee6838f62bf00ab5b95e9abb12ebeb40b323d7

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 02:12

Target

3ba00db37e83faceedc64deb1470f49f.exe
Size

64KB
MD5

3ba00db37e83faceedc64deb1470f49f
SHA1

c93e404615ad6d12ec03882abee2cc455190c9b3
SHA256

120543b1b93d090459cde3504cee6838f62bf00ab5b95e9abb12ebeb40b323d7
SHA512

46946b9ae17cab6ec63f5018604fe67586ecbd01347d84d8f4339bbfbfb0ae73408b80b71316066e72f1075eba8af724763b088389d492427029f055439e3ee8
SSDEEP

768:/KnBOYgUF2abZJZw9RACQVDgLdtVMYf7Ry3HuqyUWjbg:/AYYgUF2aZwrANfsRy3Huqy3jb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3012	2888	WerFault.exe	14

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2888	3ba00db37e83faceedc64deb1470f49f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 3012	2888	3ba00db37e83faceedc64deb1470f49f.exe	28
PID 2888 wrote to memory of 3012	2888	3ba00db37e83faceedc64deb1470f49f.exe	28
PID 2888 wrote to memory of 3012	2888	3ba00db37e83faceedc64deb1470f49f.exe	28
PID 2888 wrote to memory of 3012	2888	3ba00db37e83faceedc64deb1470f49f.exe	28

C:\Users\Admin\AppData\Local\Temp\3ba00db37e83faceedc64deb1470f49f.exe
"C:\Users\Admin\AppData\Local\Temp\3ba00db37e83faceedc64deb1470f49f.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 836
  2⤵
  - Program crash
  PID:3012