5318f58b6e3673979d1389fdaca7b156f1d51ccd6d5199bb6cb54c1ef9bae247

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-03-2024 02:00

Target

c22c4b575fad36461bb1a11b2e95e8a2.exe
Size

92KB
MD5

c22c4b575fad36461bb1a11b2e95e8a2
SHA1

5d9811a4fd292e3de97e3987c47937528f6af6c3
SHA256

5318f58b6e3673979d1389fdaca7b156f1d51ccd6d5199bb6cb54c1ef9bae247
SHA512

105f1032c6b63e3c1f7e652501679cf52fdd25597a36498e52210a92234cb27aa47ef022da9cd1d46f01b004323abe72b6d7134e6737366e7178e2d9795d5c8c
SSDEEP

1536:8mN6y7Dy3+aVU9w1fcan/pLKggI41qXeOmVy2YmEBtipNlVCdyQr1XoMJh/7DmWC:8zSgByK/gIhXg1YmOtiFVOyKocleW0EM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3044	2724	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2724	c22c4b575fad36461bb1a11b2e95e8a2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 3044	2724	c22c4b575fad36461bb1a11b2e95e8a2.exe	28
PID 2724 wrote to memory of 3044	2724	c22c4b575fad36461bb1a11b2e95e8a2.exe	28
PID 2724 wrote to memory of 3044	2724	c22c4b575fad36461bb1a11b2e95e8a2.exe	28
PID 2724 wrote to memory of 3044	2724	c22c4b575fad36461bb1a11b2e95e8a2.exe	28

C:\Users\Admin\AppData\Local\Temp\c22c4b575fad36461bb1a11b2e95e8a2.exe
"C:\Users\Admin\AppData\Local\Temp\c22c4b575fad36461bb1a11b2e95e8a2.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 208
  2⤵
  - Program crash
  PID:3044

memory/2724-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2724-1-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download