5961145d2209c1782cbdba1dcec93ac6f22b84992e4da7f328cac949e9e6d337

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 15:05

Target

b4fe17829e25705262dcb4b41c1deacc.exe
Size

5.5MB
MD5

b4fe17829e25705262dcb4b41c1deacc
SHA1

1636f8392a31682cdb2b1d567c296c55d1962c6c
SHA256

5961145d2209c1782cbdba1dcec93ac6f22b84992e4da7f328cac949e9e6d337
SHA512

cde38814fcc766b451c2849e6d210ee4c036f458a26a7d02664374007537dcdb9d684908eb7a0048bbf28e1a09ce75f11ca73496632e067d3ea4e7d74b5995e9
SSDEEP

98304:FogsbIpXyqnDiGr3q77YQ/035fUAWDLYDFVWDnv28kebNyK0LOx2rH7cyV9ksU:FogWIpXyqnb3h5ftMn+EbYK0OkNV9kl

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3012	b4fe17829e25705262dcb4b41c1deacc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2660	3012	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3012	b4fe17829e25705262dcb4b41c1deacc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2660	3012	b4fe17829e25705262dcb4b41c1deacc.exe	28
PID 3012 wrote to memory of 2660	3012	b4fe17829e25705262dcb4b41c1deacc.exe	28
PID 3012 wrote to memory of 2660	3012	b4fe17829e25705262dcb4b41c1deacc.exe	28
PID 3012 wrote to memory of 2660	3012	b4fe17829e25705262dcb4b41c1deacc.exe	28

C:\Users\Admin\AppData\Local\Temp\b4fe17829e25705262dcb4b41c1deacc.exe
"C:\Users\Admin\AppData\Local\Temp\b4fe17829e25705262dcb4b41c1deacc.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 172
  2⤵
  - Program crash
  PID:2660

memory/3012-0-0x0000000000400000-0x0000000000E13000-memory.dmp

Filesize
10.1MB

Download
memory/3012-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/3012-3-0x0000000000400000-0x0000000000E13000-memory.dmp

Filesize
10.1MB

Download
memory/3012-4-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/3012-6-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/3012-7-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/3012-8-0x0000000077680000-0x0000000077681000-memory.dmp

Filesize
4KB

Download
memory/3012-10-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/3012-12-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/3012-16-0x0000000000400000-0x0000000000E13000-memory.dmp

Filesize
10.1MB

Download