49bc47685932f577699f81cabdb4d536dc122b0b4a94e2ff6b47cee92f57e630

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/01/2024, 14:43

Target

6fb0f5d545b6f7fec351fc8af881078a.exe
Size

57KB
MD5

6fb0f5d545b6f7fec351fc8af881078a
SHA1

fff584a2ba8a8905622338a7b745ddd4cc72bc0a
SHA256

49bc47685932f577699f81cabdb4d536dc122b0b4a94e2ff6b47cee92f57e630
SHA512

5fe00d27375ffc16a8e1c2d22bb8742bb7aede29e30c2093879514ad745621683056030d11f22e26409a39a7fe7d9d15cf58d85bf207ad3b3018bf34a7081b1e
SSDEEP

768:hAWcdiE5z5+T7Ok2KMLhMk6ILHNpygwAgI0Elk8UwA:hno5+TD2Skze4gQlcwA

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2196	218316fb0f5d545b6f7fec351fc8af881078a.exe

Loads dropped DLL 6 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2540	2196	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3032	6fb0f5d545b6f7fec351fc8af881078a.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2196	3032	6fb0f5d545b6f7fec351fc8af881078a.exe	28
PID 3032 wrote to memory of 2196	3032	6fb0f5d545b6f7fec351fc8af881078a.exe	28
PID 3032 wrote to memory of 2196	3032	6fb0f5d545b6f7fec351fc8af881078a.exe	28
PID 3032 wrote to memory of 2196	3032	6fb0f5d545b6f7fec351fc8af881078a.exe	28
PID 2196 wrote to memory of 2540	2196	218316fb0f5d545b6f7fec351fc8af881078a.exe	29
PID 2196 wrote to memory of 2540	2196	218316fb0f5d545b6f7fec351fc8af881078a.exe	29
PID 2196 wrote to memory of 2540	2196	218316fb0f5d545b6f7fec351fc8af881078a.exe	29
PID 2196 wrote to memory of 2540	2196	218316fb0f5d545b6f7fec351fc8af881078a.exe	29

\Users\Admin\AppData\Local\Temp\218316fb0f5d545b6f7fec351fc8af881078a.exe

Filesize
29KB

MD5
b8051020759dc4daf5e66dfe6ba7bf0a

SHA1
b9b2f15ea21b96e6bc99ef0fcba890f61098f637

SHA256
3913c019a9c2f85ffc13c3e55ea1eb986945a362dd42539bbb5dddc5e4388713

SHA512
69adda0404204f22e20b66efa909e4980a34d0dfe9fbc1477dfc28b1446151e1e5ee7498831b6cfdcfaef578ed81c6e3e87e4e4570b6d1d137038fee699a51f8

Download Submit
memory/2196-12-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/3032-4-0x0000000000290000-0x0000000000299000-memory.dmp

Filesize
36KB

Download
memory/3032-10-0x0000000000290000-0x0000000000299000-memory.dmp

Filesize
36KB

Download