8323ef34175470f500c16e422a74718b0ec585dfee2fd7b61da3e4748a70761d

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 05:26

Target

52a7e45e54440445ff3a3470dff1e1d9.exe
Size

193KB
MD5

52a7e45e54440445ff3a3470dff1e1d9
SHA1

e784a3f7ae5ae0b3f6542352246f156629ec6daf
SHA256

8323ef34175470f500c16e422a74718b0ec585dfee2fd7b61da3e4748a70761d
SHA512

8139adb97784ead0ed44b4cda6d56ef86b3e208fe70da7a910d1e8f914e7d12dd940c745c4b925727940d1ed55177afcfcbf001754ef853b35c6c98da29e257c
SSDEEP

3072:P/uSnUuEgbB3cTlji/6kSM81gcyD63BgFbBdH6lgyFhMTBlp:/bB3j/6k8/yWS0uy8lp

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2748	HelpMe.exe

Loads dropped DLL 6 IoCs

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\HelpMe.exe	52a7e45e54440445ff3a3470dff1e1d9.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2512	2748	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2220	52a7e45e54440445ff3a3470dff1e1d9.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2748	2220	52a7e45e54440445ff3a3470dff1e1d9.exe	28
PID 2220 wrote to memory of 2748	2220	52a7e45e54440445ff3a3470dff1e1d9.exe	28
PID 2220 wrote to memory of 2748	2220	52a7e45e54440445ff3a3470dff1e1d9.exe	28
PID 2220 wrote to memory of 2748	2220	52a7e45e54440445ff3a3470dff1e1d9.exe	28
PID 2748 wrote to memory of 2512	2748	HelpMe.exe	29
PID 2748 wrote to memory of 2512	2748	HelpMe.exe	29
PID 2748 wrote to memory of 2512	2748	HelpMe.exe	29
PID 2748 wrote to memory of 2512	2748	HelpMe.exe	29

\Windows\SysWOW64\HelpMe.exe

Filesize
69KB

MD5
461b689a27409738905d44882e94e5f6

SHA1
7d628e15b2f6ef08f704f9154d26794a09df2c92

SHA256
dcb5f27f4431eb20034fcdf7dc4a1d4ad3d9d5255b54e3a1cd94d861ad491b8c

SHA512
e54c4298e1f3e7d947f4f941b7fe459a3bc74b464974f95a8fc4623504e1c4b186a46a323a99239a91349a5d72ac15b5a562a36ef5c72f855823cc9c5c08bbe7

Download Submit
memory/2220-7-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2220-14-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2748-15-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download