62c6c044e5c8ff505bed4a231f85b477afd80ae7a29cc2a6802c893d11c2ad11

Resubmissions

05/03/2024, 15:24

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 15:24

Target

poom_1.9_windows/poom_1.9.exe
Size

1.3MB
MD5

829feffa22105b7ae25e848a1f705a36
SHA1

00e31e01e7215dc09daa2bebd64ff5412b94f9a8
SHA256

271e36b0064e2dc2f14aa53b373b371f9fbcd1ae995e98f847224a72f62a395a
SHA512

dcb701f629bc66fd3632df3e4b4f1d9b5368d245f6652673559bf3c505300a4a6c99c721bb262310306ebd2af900c59b89b39bfe933288f08f561300b36c67ee
SSDEEP

24576:t3jjNtnY267WzCjita9bTTBb0vNe+5LLFiN0pc:tltOQOT92NNG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3060	1804	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1804	poom_1.9.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 3060	1804	poom_1.9.exe	28
PID 1804 wrote to memory of 3060	1804	poom_1.9.exe	28
PID 1804 wrote to memory of 3060	1804	poom_1.9.exe	28
PID 1804 wrote to memory of 3060	1804	poom_1.9.exe	28

C:\Users\Admin\AppData\Local\Temp\poom_1.9_windows\poom_1.9.exe
"C:\Users\Admin\AppData\Local\Temp\poom_1.9_windows\poom_1.9.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 572
  2⤵
  - Program crash
  PID:3060

memory/1804-1-0x0000000000BE0000-0x0000000000BEA000-memory.dmp

Filesize
40KB

Download
memory/1804-2-0x0000000000BE0000-0x0000000000BEA000-memory.dmp

Filesize
40KB

Download
memory/1804-3-0x0000000000BE0000-0x0000000000BEA000-memory.dmp

Filesize
40KB

Download
memory/1804-4-0x0000000000400000-0x000000000085C000-memory.dmp

Filesize
4.4MB

Download
memory/1804-5-0x000000006C940000-0x000000006CA53000-memory.dmp

Filesize
1.1MB

Download