527b87a1150d0f572a45382c218a06fa35f0306b870b842ef7bceecf6c5cc248

Analysis

max time kernel
141s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 06:29

Target

c2aeb23c64873f0de03781e2c94d3d1d.exe
Size

226KB
MD5

c2aeb23c64873f0de03781e2c94d3d1d
SHA1

7936a4fc704d6c292f51ea9ccb3b2274a806f699
SHA256

527b87a1150d0f572a45382c218a06fa35f0306b870b842ef7bceecf6c5cc248
SHA512

6d7ffc13be1b25d60a4629b5717ae44877ece3f2389a8914b0dabd00a15e0a9df3666d0467970c7403260400b35748303d598e51b0de222399f833b190b1a30b
SSDEEP

6144:IKMdScZS4A03Q1FcIAumE+eSq9tOcr/Er/ti:IBdhAJ1CIA3pfetOcQr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
760	2952	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2952	c2aeb23c64873f0de03781e2c94d3d1d.exe
2952	c2aeb23c64873f0de03781e2c94d3d1d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 760	2952	c2aeb23c64873f0de03781e2c94d3d1d.exe	28
PID 2952 wrote to memory of 760	2952	c2aeb23c64873f0de03781e2c94d3d1d.exe	28
PID 2952 wrote to memory of 760	2952	c2aeb23c64873f0de03781e2c94d3d1d.exe	28
PID 2952 wrote to memory of 760	2952	c2aeb23c64873f0de03781e2c94d3d1d.exe	28

C:\Users\Admin\AppData\Local\Temp\c2aeb23c64873f0de03781e2c94d3d1d.exe
"C:\Users\Admin\AppData\Local\Temp\c2aeb23c64873f0de03781e2c94d3d1d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 304
  2⤵
  - Program crash
  PID:760

memory/2952-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2952-1-0x0000000000220000-0x0000000000258000-memory.dmp

Filesize
224KB

Download
memory/2952-2-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2952-3-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2952-4-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2952-6-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download