766d2df0bf5a18735e049893216fd989fead6e55b02b93180a8277f848166ae3

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15/01/2024, 03:39

Target

5c09c42c113c33b3b77b59a17019f4a2.exe
Size

228KB
MD5

5c09c42c113c33b3b77b59a17019f4a2
SHA1

080bb33cb3a02a2f0fefd51e01551b119b35f2c5
SHA256

766d2df0bf5a18735e049893216fd989fead6e55b02b93180a8277f848166ae3
SHA512

134665c518309ae7f3986a494bb7f8e0f792300082785609473a2c6b0b159b60177d1484b843f8b86f65f06d47070e6fc0dfb0f493bc3ceddf7e964829e319d1
SSDEEP

6144:HPKTgECGOl0w3PXoIPMtyAxzNpY2kdgx:CTgRGOKsOyAxL1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1792	3052	WerFault.exe	16

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3052	5c09c42c113c33b3b77b59a17019f4a2.exe
3052	5c09c42c113c33b3b77b59a17019f4a2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 1792	3052	5c09c42c113c33b3b77b59a17019f4a2.exe	28
PID 3052 wrote to memory of 1792	3052	5c09c42c113c33b3b77b59a17019f4a2.exe	28
PID 3052 wrote to memory of 1792	3052	5c09c42c113c33b3b77b59a17019f4a2.exe	28
PID 3052 wrote to memory of 1792	3052	5c09c42c113c33b3b77b59a17019f4a2.exe	28

C:\Users\Admin\AppData\Local\Temp\5c09c42c113c33b3b77b59a17019f4a2.exe
"C:\Users\Admin\AppData\Local\Temp\5c09c42c113c33b3b77b59a17019f4a2.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 304
  2⤵
  - Program crash
  PID:1792

memory/3052-1-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3052-2-0x0000000000220000-0x0000000000258000-memory.dmp

Filesize
224KB

Download
memory/3052-0-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3052-4-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/3052-3-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3052-5-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3052-7-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download