f0cd1dddd4c601d663a6ff01db1792d6c2fbf45ce75a1501c5d85099491e2e44

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 04:26

Target

bfd77c301ec14ab5969f3648df485ae2.exe
Size

60KB
MD5

bfd77c301ec14ab5969f3648df485ae2
SHA1

35cf238632a36dbb7e7513b6c28fa5e132f6e408
SHA256

f0cd1dddd4c601d663a6ff01db1792d6c2fbf45ce75a1501c5d85099491e2e44
SHA512

6875aa0df169420c20c049df5e13ad36f0b467f2e0450a279b82f03eeb51a49680410e194c15920a6680c8bed2b55e704d2c0cd9437502ff0fcd7b8298bdd516
SSDEEP

768:JeoRydZw1RTNoHY0kl5BMbbxgRXqt8fJwiHiqxhx7bikFMzTW:JeoMZGRyHYWEmiiqxhhikSHW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2420	1420	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1420	bfd77c301ec14ab5969f3648df485ae2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 2420	1420	bfd77c301ec14ab5969f3648df485ae2.exe	28
PID 1420 wrote to memory of 2420	1420	bfd77c301ec14ab5969f3648df485ae2.exe	28
PID 1420 wrote to memory of 2420	1420	bfd77c301ec14ab5969f3648df485ae2.exe	28
PID 1420 wrote to memory of 2420	1420	bfd77c301ec14ab5969f3648df485ae2.exe	28

C:\Users\Admin\AppData\Local\Temp\bfd77c301ec14ab5969f3648df485ae2.exe
"C:\Users\Admin\AppData\Local\Temp\bfd77c301ec14ab5969f3648df485ae2.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 188
  2⤵
  - Program crash
  PID:2420

memory/1420-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download