8e1b57c8a9c1831b9f4af30ac8f06bcd0ad1464c876a059e873d67972f181290

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 05:49

Target

4a9a9b7aac298cee498ce1cb806a2358.exe
Size

55KB
MD5

4a9a9b7aac298cee498ce1cb806a2358
SHA1

7939a680b0fb86f0eb80388342e9d6adb244ca42
SHA256

8e1b57c8a9c1831b9f4af30ac8f06bcd0ad1464c876a059e873d67972f181290
SHA512

6b0b7b73620ba4bcf2ef2803b774dd700df7d65ec9718ced52ea0f3cfa7a9c7ca69493153875bf187bd55de5c73c86a77b1ae875131a3f39ca4dce8976bf899c
SSDEEP

768:j2w5yeww45SX5wPGuL482mjdiSk9J4cbmCNjE1mkOt1GV6xCkV:jmewhSX5Yg82mQrJdN41mkO/G60kV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2844	3024	WerFault.exe	14

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3024	4a9a9b7aac298cee498ce1cb806a2358.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2508	3024	4a9a9b7aac298cee498ce1cb806a2358.exe	28
PID 3024 wrote to memory of 2508	3024	4a9a9b7aac298cee498ce1cb806a2358.exe	28
PID 3024 wrote to memory of 2508	3024	4a9a9b7aac298cee498ce1cb806a2358.exe	28
PID 3024 wrote to memory of 2508	3024	4a9a9b7aac298cee498ce1cb806a2358.exe	28
PID 3024 wrote to memory of 2508	3024	4a9a9b7aac298cee498ce1cb806a2358.exe	28
PID 3024 wrote to memory of 2508	3024	4a9a9b7aac298cee498ce1cb806a2358.exe	28
PID 3024 wrote to memory of 2844	3024	4a9a9b7aac298cee498ce1cb806a2358.exe	29
PID 3024 wrote to memory of 2844	3024	4a9a9b7aac298cee498ce1cb806a2358.exe	29
PID 3024 wrote to memory of 2844	3024	4a9a9b7aac298cee498ce1cb806a2358.exe	29
PID 3024 wrote to memory of 2844	3024	4a9a9b7aac298cee498ce1cb806a2358.exe	29

C:\Users\Admin\AppData\Local\Temp\4a9a9b7aac298cee498ce1cb806a2358.exe
"C:\Users\Admin\AppData\Local\Temp\4a9a9b7aac298cee498ce1cb806a2358.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\4a9a9b7aac298cee498ce1cb806a2358.exe
  C:\Users\Admin\AppData\Local\Temp\4a9a9b7aac298cee498ce1cb806a2358.exe
  2⤵
  PID:2508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 244
  2⤵
  - Program crash
  PID:2844

memory/2508-4-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2508-2-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download