46ef85b7ba1c318ad626e209400e738b878e218f6a25dc46bfbea4038831dce5

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 02:36

Target

790e12d0411dc947f0370d476830424a.exe
Size

68KB
MD5

790e12d0411dc947f0370d476830424a
SHA1

1830cbb0e9e7d81f7deabf622a9a619f73540e39
SHA256

46ef85b7ba1c318ad626e209400e738b878e218f6a25dc46bfbea4038831dce5
SHA512

c0de729dc3fe1a36a254738905e69a3d1a73f0046320356bcb7657fc69c600795527f47086d164ed484dab985e587d724750f1ff53548e5c7bbbf3088b7c97b6
SSDEEP

768:V/kichnndZQefxpeMwd1Jg5Y7wWLBPJpXSKgLBPRXj:1kic1ndZQefYlg5UwWVBpXSKgVZXj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1904	2904	WerFault.exe	1

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2904	790e12d0411dc947f0370d476830424a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 1904	2904	790e12d0411dc947f0370d476830424a.exe	28
PID 2904 wrote to memory of 1904	2904	790e12d0411dc947f0370d476830424a.exe	28
PID 2904 wrote to memory of 1904	2904	790e12d0411dc947f0370d476830424a.exe	28
PID 2904 wrote to memory of 1904	2904	790e12d0411dc947f0370d476830424a.exe	28

C:\Users\Admin\AppData\Local\Temp\790e12d0411dc947f0370d476830424a.exe
"C:\Users\Admin\AppData\Local\Temp\790e12d0411dc947f0370d476830424a.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 188
  2⤵
  - Program crash
  PID:1904