36339a62190b89a2c37c7918e0bf51564b81a885d9d9b2d2eabad2a572ada47a

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/01/2024, 17:47

Target

6fec5240f3eeff7d7be7b91dad0291af.exe
Size

228KB
MD5

6fec5240f3eeff7d7be7b91dad0291af
SHA1

a7f287139f48aae85ccf300814b552f346245f19
SHA256

36339a62190b89a2c37c7918e0bf51564b81a885d9d9b2d2eabad2a572ada47a
SHA512

81f9e41186271aed3be8fda7023a5f628328d97d700d275f6679a88a992951f2785309035c0bcb1fbd0327c0cf29ecf41f2abf6c8d6ed2b72ffc8ccfb3b9d30e
SSDEEP

3072:Jyz4+SxOQ2fDrJSrHiYn594gExWKSTWn0epsmM3GmNaFxH8K9j96RcFdYPnMHZX2:w45xaFSjbJExQzepsmjH8K7lYP4D3qV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1824	2392	WerFault.exe	14

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2392	6fec5240f3eeff7d7be7b91dad0291af.exe
2392	6fec5240f3eeff7d7be7b91dad0291af.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1824	2392	6fec5240f3eeff7d7be7b91dad0291af.exe	28
PID 2392 wrote to memory of 1824	2392	6fec5240f3eeff7d7be7b91dad0291af.exe	28
PID 2392 wrote to memory of 1824	2392	6fec5240f3eeff7d7be7b91dad0291af.exe	28
PID 2392 wrote to memory of 1824	2392	6fec5240f3eeff7d7be7b91dad0291af.exe	28

C:\Users\Admin\AppData\Local\Temp\6fec5240f3eeff7d7be7b91dad0291af.exe
"C:\Users\Admin\AppData\Local\Temp\6fec5240f3eeff7d7be7b91dad0291af.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 300
  2⤵
  - Program crash
  PID:1824

memory/2392-0-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2392-1-0x00000000001B0000-0x00000000001E8000-memory.dmp

Filesize
224KB

Download
memory/2392-2-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2392-3-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2392-4-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2392-6-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download