a2857fcda3f23e8d9b6de81c5e21c9939427900fac3bb4cb7ed4c6e363419182

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 09:02

Target

867ab4e21183e6c05a096cf638087a86.exe
Size

340KB
MD5

867ab4e21183e6c05a096cf638087a86
SHA1

4ce475eabff5db224c5661bf21be28b6af987a17
SHA256

a2857fcda3f23e8d9b6de81c5e21c9939427900fac3bb4cb7ed4c6e363419182
SHA512

570ef5420a701e28c7d0abb35fc53db044ef894fca011d279af5587b6d27e99a3179d667fee06b6e194623c1b2073c3f879a71454d79b8b056a01750eec5cf89
SSDEEP

6144:VFOnR9SLkWor+akVC5s/durgm7hv8htqiXkIvaX/m7bfTWaUspmHjYT9oFv6wHHn:bOR9SLkWor+akVC5s/dIdEhtqiXkIvab

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1376	2212	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2212	867ab4e21183e6c05a096cf638087a86.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 1376	2212	867ab4e21183e6c05a096cf638087a86.exe	28
PID 2212 wrote to memory of 1376	2212	867ab4e21183e6c05a096cf638087a86.exe	28
PID 2212 wrote to memory of 1376	2212	867ab4e21183e6c05a096cf638087a86.exe	28
PID 2212 wrote to memory of 1376	2212	867ab4e21183e6c05a096cf638087a86.exe	28

C:\Users\Admin\AppData\Local\Temp\867ab4e21183e6c05a096cf638087a86.exe
"C:\Users\Admin\AppData\Local\Temp\867ab4e21183e6c05a096cf638087a86.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 196
  2⤵
  - Program crash
  PID:1376