0127a14e6e7eebf42a3e92a4c3424d55c5974f4d2d0b60c7e896a384d97be610

Analysis

max time kernel
143s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 09:16

Target

0127a14e6e7eebf42a3e92a4c3424d55c5974f4d2d0b60c7e896a384d97be610.exe
Size

10.0MB
MD5

1425450968a2831df5d8def5e6bd5ed8
SHA1

ec69109e11bbce7dbdc279ee80a0e67e894cbc09
SHA256

0127a14e6e7eebf42a3e92a4c3424d55c5974f4d2d0b60c7e896a384d97be610
SHA512

dc8b2c68968601afe86f815422e9b97669c27c8b90514f95bc1d6b1d57a03ddebddbd662cd46afce51f34ceb7b629b1d6509da5960cc7aa1567f005c104273f4
SSDEEP

196608:SlxZOah3pyCmbrgmhwVT5e2N/nHqicGRRuV6PYP14/BBOkB2CJp1F:SljBptm3gmaVt3Nvqice0wPE4/aBCJd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2004	2772	WerFault.exe	21

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2772	0127a14e6e7eebf42a3e92a4c3424d55c5974f4d2d0b60c7e896a384d97be610.exe
2772	0127a14e6e7eebf42a3e92a4c3424d55c5974f4d2d0b60c7e896a384d97be610.exe
2772	0127a14e6e7eebf42a3e92a4c3424d55c5974f4d2d0b60c7e896a384d97be610.exe
2772	0127a14e6e7eebf42a3e92a4c3424d55c5974f4d2d0b60c7e896a384d97be610.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2004	2772	0127a14e6e7eebf42a3e92a4c3424d55c5974f4d2d0b60c7e896a384d97be610.exe	28
PID 2772 wrote to memory of 2004	2772	0127a14e6e7eebf42a3e92a4c3424d55c5974f4d2d0b60c7e896a384d97be610.exe	28
PID 2772 wrote to memory of 2004	2772	0127a14e6e7eebf42a3e92a4c3424d55c5974f4d2d0b60c7e896a384d97be610.exe	28
PID 2772 wrote to memory of 2004	2772	0127a14e6e7eebf42a3e92a4c3424d55c5974f4d2d0b60c7e896a384d97be610.exe	28

C:\Users\Admin\AppData\Local\Temp\0127a14e6e7eebf42a3e92a4c3424d55c5974f4d2d0b60c7e896a384d97be610.exe
"C:\Users\Admin\AppData\Local\Temp\0127a14e6e7eebf42a3e92a4c3424d55c5974f4d2d0b60c7e896a384d97be610.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 384
  2⤵
  - Program crash
  PID:2004

memory/2772-0-0x0000000000400000-0x0000000001DCC000-memory.dmp

Filesize
25.8MB

Download
memory/2772-1-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download
memory/2772-2-0x0000000000400000-0x0000000001DCC000-memory.dmp

Filesize
25.8MB

Download
memory/2772-5-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download
memory/2772-6-0x0000000000400000-0x0000000001DCC000-memory.dmp

Filesize
25.8MB

Download
memory/2772-8-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download