2305c6de45d5a0cf0dde360639c22409a583f3a6b1af0f1a0d1eb1a0e4db9a47

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-03-2024 00:29

Target

bd3306f0028779b4e9230da8081f0e47.exe
Size

24KB
MD5

bd3306f0028779b4e9230da8081f0e47
SHA1

f8bb455e0211ba931b95d123faf65d18d27c39ab
SHA256

2305c6de45d5a0cf0dde360639c22409a583f3a6b1af0f1a0d1eb1a0e4db9a47
SHA512

b13f6064c91bf30ee48ed2da1ca59ce4c60d3ed312c94e431c766c6367252fd42d96e07ca27eb1c9fcecc4d2dfded034b6bc2c340f845aaffd028881a7da700c
SSDEEP

192:3mk39HyBeT3LjKgdkkgPUu9RsmXH4L7QfLFKPKfDs4QJeNyBeT3LjK:WktSBqX/XOUu9IvQfLFBDs4QJecBqX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2772	1996	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1996	bd3306f0028779b4e9230da8081f0e47.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2772	1996	bd3306f0028779b4e9230da8081f0e47.exe	28
PID 1996 wrote to memory of 2772	1996	bd3306f0028779b4e9230da8081f0e47.exe	28
PID 1996 wrote to memory of 2772	1996	bd3306f0028779b4e9230da8081f0e47.exe	28
PID 1996 wrote to memory of 2772	1996	bd3306f0028779b4e9230da8081f0e47.exe	28

C:\Users\Admin\AppData\Local\Temp\bd3306f0028779b4e9230da8081f0e47.exe
"C:\Users\Admin\AppData\Local\Temp\bd3306f0028779b4e9230da8081f0e47.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 248
  2⤵
  - Program crash
  PID:2772