5c2dba8b207a91ebd5da1b3478cd0a61ff18f8f58148d88d72e468d88c37ee60

Analysis

max time kernel
122s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 13:19

Target

3e975b641ef8ad5cc63683eb8f34759e.exe
Size

172KB
MD5

3e975b641ef8ad5cc63683eb8f34759e
SHA1

f588ee9c26e6a1a50284d2aabaa6eef5fc0cd1a5
SHA256

5c2dba8b207a91ebd5da1b3478cd0a61ff18f8f58148d88d72e468d88c37ee60
SHA512

6c2e9f99e4e8acdea09184adda1b8be2ab17f387696535d54ca2546c3978b9103710559b5eeb44703b0ee6a5f435564ed047759189dd7a6ee4d4e90df81499fa
SSDEEP

3072:4o33QXXeRgw3tiKnvmb7/D26nYNpnHzqTT8RUFwjkKvLg3dvCgIHzmWZAlGbB9ix:4GAXXeR1UKnvmb7/D26nSnTqTT8RUFwW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2816	2744	WerFault.exe	26

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2744	3e975b641ef8ad5cc63683eb8f34759e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2816	2744	3e975b641ef8ad5cc63683eb8f34759e.exe	27
PID 2744 wrote to memory of 2816	2744	3e975b641ef8ad5cc63683eb8f34759e.exe	27
PID 2744 wrote to memory of 2816	2744	3e975b641ef8ad5cc63683eb8f34759e.exe	27
PID 2744 wrote to memory of 2816	2744	3e975b641ef8ad5cc63683eb8f34759e.exe	27

C:\Users\Admin\AppData\Local\Temp\3e975b641ef8ad5cc63683eb8f34759e.exe
"C:\Users\Admin\AppData\Local\Temp\3e975b641ef8ad5cc63683eb8f34759e.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 188
  2⤵
  - Program crash
  PID:2816

memory/2744-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download