50b085787026144759fa5703090d100737fee7a72bf55de0ff906f8125f959e4

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 03:03

Target

7bf96581990117c6932641ce0697813e.exe
Size

108KB
MD5

7bf96581990117c6932641ce0697813e
SHA1

97dfa184b4fbcea30ef59a9e2bf27c7c4a76252e
SHA256

50b085787026144759fa5703090d100737fee7a72bf55de0ff906f8125f959e4
SHA512

53627470240e317fd3f142a515184565551ed014d6333d6b72b400e7b532fd57571d1c2ef2c66a4edc083b66425356c5eaa8f1bb4cab1c4767a7d453cd2139cf
SSDEEP

1536:dtPbRw/RWN6tvRyqBtAcaDGXmzsLbYeTtZsDWBN6krXl7gHzFtiqFlK:ARWNg3tAcsUYeTHrXl7EFY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2400	760	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
760	7bf96581990117c6932641ce0697813e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 2400	760	7bf96581990117c6932641ce0697813e.exe	28
PID 760 wrote to memory of 2400	760	7bf96581990117c6932641ce0697813e.exe	28
PID 760 wrote to memory of 2400	760	7bf96581990117c6932641ce0697813e.exe	28
PID 760 wrote to memory of 2400	760	7bf96581990117c6932641ce0697813e.exe	28

C:\Users\Admin\AppData\Local\Temp\7bf96581990117c6932641ce0697813e.exe
"C:\Users\Admin\AppData\Local\Temp\7bf96581990117c6932641ce0697813e.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 188
  2⤵
  - Program crash
  PID:2400