3d0c7be2515e32d8b1c3057762c2e493d4bcff5e0da65a322003e7e2969d886a

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 07:33

Target

9b2005c896737cbc215286041d53a095.exe
Size

24KB
MD5

9b2005c896737cbc215286041d53a095
SHA1

b6450b457a1fda67b227e4423f019388719077b9
SHA256

3d0c7be2515e32d8b1c3057762c2e493d4bcff5e0da65a322003e7e2969d886a
SHA512

ba707c439e77cfd0ecb526fd6c101a985ce80189b40cfd2e71f9e17102e179842592ffb71324cf689c658c90a094711d52841d820041cecc919b8e0f79021403
SSDEEP

192:/TWbm3bOFOe6G5DCeuKhNUhk3B6vm/DDDn1MOFOe61K:/TWbEbOFL5DluGNU2Q0DDn1MOFaK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2432	1664	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1664	9b2005c896737cbc215286041d53a095.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2432	1664	9b2005c896737cbc215286041d53a095.exe	28
PID 1664 wrote to memory of 2432	1664	9b2005c896737cbc215286041d53a095.exe	28
PID 1664 wrote to memory of 2432	1664	9b2005c896737cbc215286041d53a095.exe	28
PID 1664 wrote to memory of 2432	1664	9b2005c896737cbc215286041d53a095.exe	28

C:\Users\Admin\AppData\Local\Temp\9b2005c896737cbc215286041d53a095.exe
"C:\Users\Admin\AppData\Local\Temp\9b2005c896737cbc215286041d53a095.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 228
  2⤵
  - Program crash
  PID:2432

memory/1664-0-0x0000000000400000-0x0000000000405B70-memory.dmp

Filesize
22KB

Download