2d30a13b39a0b56f3c13a7511a4fd9408e75a00d8b757d8226e25ba29cf9c6b7

Resubmissions

21/02/2024, 01:05

21/02/2024, 01:05

max time kernel
3s
max time network
3s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 01:05

Target

301ViewPumper.exe
Size

259KB
MD5

71b36e0eda7c6a820a531b13733a3bc8
SHA1

a923dabd8fc3f8bfef92b012475c04adcb788b33
SHA256

08af2cd516873ee978b4be028c13b395bc07f73216dce18d7e18fbad0dd02a14
SHA512

7fd5d8e056640d90d4dbd96c1812c328963ad0b83a7e84ec9140508a85cd04b892e5d99ebf5d82a0a4b90eac4d7e07f51fb5c76aac20cb914f7cb288148f873a
SSDEEP

6144:eWzfVvlH9GG5or7iuWHYVXX4ujmwR3+ifNKFER:eWz8G6r7iuWcX4ujmwR3+ifNKFER

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2944	301ViewPumper.exe
2944	301ViewPumper.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2804	2944	301ViewPumper.exe	28
PID 2944 wrote to memory of 2804	2944	301ViewPumper.exe	28
PID 2944 wrote to memory of 2804	2944	301ViewPumper.exe	28

C:\Users\Admin\AppData\Local\Temp\301ViewPumper.exe
"C:\Users\Admin\AppData\Local\Temp\301ViewPumper.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2944 -s 772
  2⤵
  PID:2804

memory/2944-0-0x00000000012A0000-0x00000000012E6000-memory.dmp

Filesize
280KB

Download
memory/2944-1-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmp

Filesize
9.9MB

Download
memory/2944-2-0x000000001AF40000-0x000000001AFC0000-memory.dmp

Filesize
512KB

Download
memory/2944-3-0x00000000003C0000-0x00000000003F2000-memory.dmp

Filesize
200KB

Download
memory/2944-4-0x0000000000770000-0x00000000007E6000-memory.dmp

Filesize
472KB

Download
memory/2944-5-0x000000001AF40000-0x000000001AFC0000-memory.dmp

Filesize
512KB

Download