c459889afe3ddb4e5607d354a891d215b34178140e02ab4c1786c202304d0b26

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 00:32

Target

98054be4375b7ba8ad313ce7bbb07e53.exe
Size

176KB
MD5

98054be4375b7ba8ad313ce7bbb07e53
SHA1

29f7995041169fa8d63b129514686904887b368f
SHA256

c459889afe3ddb4e5607d354a891d215b34178140e02ab4c1786c202304d0b26
SHA512

3ebbbe088a7dca89d2d76436e56d4fad5c99ad0417200553eb53b2cc97d4a6d729128570dc45c3fa5d035d6d737385f1ef1f2b67cfde526c54d45712150f45b8
SSDEEP

3072:WP4IcfpHlp1DbKcwjIU2aTObcpT/pHkEAbN/yK/fObT/bGiCV/COqoSQiiBuAZdI:E4PfpHlp1vKcwjIDaTObcZ/pHkMK/fOJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2920	2480	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2480	98054be4375b7ba8ad313ce7bbb07e53.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2920	2480	98054be4375b7ba8ad313ce7bbb07e53.exe	28
PID 2480 wrote to memory of 2920	2480	98054be4375b7ba8ad313ce7bbb07e53.exe	28
PID 2480 wrote to memory of 2920	2480	98054be4375b7ba8ad313ce7bbb07e53.exe	28
PID 2480 wrote to memory of 2920	2480	98054be4375b7ba8ad313ce7bbb07e53.exe	28

C:\Users\Admin\AppData\Local\Temp\98054be4375b7ba8ad313ce7bbb07e53.exe
"C:\Users\Admin\AppData\Local\Temp\98054be4375b7ba8ad313ce7bbb07e53.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 188
  2⤵
  - Program crash
  PID:2920