6ec6cbacf1f5e170827e5ade30a98e918f16956b5dd071e9bfa639b418febf92

Analysis

max time kernel
148s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 20:28

Target

6ec6cbacf1f5e170827e5ade30a98e918f16956b5dd071e9bfa639b418febf92.exe
Size

1.1MB
MD5

00fbbba359a16dfea307686e15d1170c
SHA1

d0dbd86e84083902842d14f427f400d679659af0
SHA256

6ec6cbacf1f5e170827e5ade30a98e918f16956b5dd071e9bfa639b418febf92
SHA512

ec70ba5da478a2e3a21f8053430c2dd13b60722d13af59d0a98a0c24c5bffa3d0bc29262287b6e23837d8496ac2d74b4ec2451e6d2bf4707dfc564cc57b189ab
SSDEEP

24576:wkrftCV7nLDX0HoCaqTkK80TcUfbYB22kmpb24f54MvMl:wuwL72TQ0TBYB22kmpb24f54l

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4968	3984	WerFault.exe	96

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3984	6ec6cbacf1f5e170827e5ade30a98e918f16956b5dd071e9bfa639b418febf92.exe
3984	6ec6cbacf1f5e170827e5ade30a98e918f16956b5dd071e9bfa639b418febf92.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 3984	2880	6ec6cbacf1f5e170827e5ade30a98e918f16956b5dd071e9bfa639b418febf92.exe	96
PID 2880 wrote to memory of 3984	2880	6ec6cbacf1f5e170827e5ade30a98e918f16956b5dd071e9bfa639b418febf92.exe	96
PID 2880 wrote to memory of 3984	2880	6ec6cbacf1f5e170827e5ade30a98e918f16956b5dd071e9bfa639b418febf92.exe	96

C:\Users\Admin\AppData\Local\Temp\6ec6cbacf1f5e170827e5ade30a98e918f16956b5dd071e9bfa639b418febf92.exe
"C:\Users\Admin\AppData\Local\Temp\6ec6cbacf1f5e170827e5ade30a98e918f16956b5dd071e9bfa639b418febf92.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Local\Temp\6ec6cbacf1f5e170827e5ade30a98e918f16956b5dd071e9bfa639b418febf92.exe
  "C:\Users\Admin\AppData\Local\Temp\6ec6cbacf1f5e170827e5ade30a98e918f16956b5dd071e9bfa639b418febf92.exe" --cp
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 2000
    3⤵
    - Program crash
    PID:4968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4612 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3984 -ip 3984
1⤵
PID:3260