f043fc40c885ba5c94978938be9840daf360fb67c94a1613033e3d5ab2b453b7

Analysis

max time kernel
142s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-01-2024 02:32

Target

f043fc40c885ba5c94978938be9840daf360fb67c94a1613033e3d5ab2b453b7.exe
Size

6.1MB
MD5

783d2cd26053a6e7feb1b81405f23a1a
SHA1

865e179ac458a838d8c3109983b31c4f7e7e15d5
SHA256

f043fc40c885ba5c94978938be9840daf360fb67c94a1613033e3d5ab2b453b7
SHA512

f24a148b6fbb0bc449fe3844a8f668e8a070ed8c37b4529e9eba4eea9eb1fdd781bd6fe6102bc92a491569d2eaab5eaa70b9fffd6d7ae24a15b6148b6bdc3136
SSDEEP

98304:3SK77hgJd1UcN/qyd4wuNkpFED4/dk/Z8uRDg1rhivANbD4Smoz3Kh2rHOEaeIdh:3JXhg9UcN/qpGQ8uR1YtZvOszddIX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2128	1648	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1648	f043fc40c885ba5c94978938be9840daf360fb67c94a1613033e3d5ab2b453b7.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1648	f043fc40c885ba5c94978938be9840daf360fb67c94a1613033e3d5ab2b453b7.exe
1648	f043fc40c885ba5c94978938be9840daf360fb67c94a1613033e3d5ab2b453b7.exe
1648	f043fc40c885ba5c94978938be9840daf360fb67c94a1613033e3d5ab2b453b7.exe
1648	f043fc40c885ba5c94978938be9840daf360fb67c94a1613033e3d5ab2b453b7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2128	1648	f043fc40c885ba5c94978938be9840daf360fb67c94a1613033e3d5ab2b453b7.exe	28
PID 1648 wrote to memory of 2128	1648	f043fc40c885ba5c94978938be9840daf360fb67c94a1613033e3d5ab2b453b7.exe	28
PID 1648 wrote to memory of 2128	1648	f043fc40c885ba5c94978938be9840daf360fb67c94a1613033e3d5ab2b453b7.exe	28
PID 1648 wrote to memory of 2128	1648	f043fc40c885ba5c94978938be9840daf360fb67c94a1613033e3d5ab2b453b7.exe	28

C:\Users\Admin\AppData\Local\Temp\f043fc40c885ba5c94978938be9840daf360fb67c94a1613033e3d5ab2b453b7.exe
"C:\Users\Admin\AppData\Local\Temp\f043fc40c885ba5c94978938be9840daf360fb67c94a1613033e3d5ab2b453b7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 484
  2⤵
  - Program crash
  PID:2128

memory/1648-0-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download
memory/1648-1-0x0000000000240000-0x0000000000243000-memory.dmp

Filesize
12KB

Download
memory/1648-2-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download
memory/1648-5-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download
memory/1648-6-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download
memory/1648-8-0x0000000000240000-0x0000000000243000-memory.dmp

Filesize
12KB

Download