35439e9e062d34f293d426bf178c57bec3cc618bfa1c37db0627b66d885926ea

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 10:21

Target

cdce3e32e9637426e790e00b88b0760d.exe
Size

8.6MB
MD5

cdce3e32e9637426e790e00b88b0760d
SHA1

36238a5ed4fbf2a9c843da303e4332b8ad1ec746
SHA256

35439e9e062d34f293d426bf178c57bec3cc618bfa1c37db0627b66d885926ea
SHA512

5d31cb2cd6268f1e344081a5a1b7f868cb4508fceb1f555f4a7fe361a6d5f6f52827c0c79c2dff40510d1771beadbebb389d0e2a72247e266f0a9d5921681134
SSDEEP

98304:q3WIosGshkzIJYHKvbruN6Q6BYCmA5RnEqgHUGtln1dZaoKAvtsGiZq2X:qcsGshXcgOTD1/aoK4wZq2X

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2548	1888	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1888	cdce3e32e9637426e790e00b88b0760d.exe
1888	cdce3e32e9637426e790e00b88b0760d.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2500	1888	cdce3e32e9637426e790e00b88b0760d.exe	28
PID 1888 wrote to memory of 2500	1888	cdce3e32e9637426e790e00b88b0760d.exe	28
PID 1888 wrote to memory of 2500	1888	cdce3e32e9637426e790e00b88b0760d.exe	28
PID 1888 wrote to memory of 2500	1888	cdce3e32e9637426e790e00b88b0760d.exe	28
PID 1888 wrote to memory of 2548	1888	cdce3e32e9637426e790e00b88b0760d.exe	29
PID 1888 wrote to memory of 2548	1888	cdce3e32e9637426e790e00b88b0760d.exe	29
PID 1888 wrote to memory of 2548	1888	cdce3e32e9637426e790e00b88b0760d.exe	29
PID 1888 wrote to memory of 2548	1888	cdce3e32e9637426e790e00b88b0760d.exe	29

C:\Users\Admin\AppData\Local\Temp\cdce3e32e9637426e790e00b88b0760d.exe
"C:\Users\Admin\AppData\Local\Temp\cdce3e32e9637426e790e00b88b0760d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 224
  2⤵
  - Program crash
  PID:2548

memory/1888-0-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1888-2-0x0000000000400000-0x0000000000C15000-memory.dmp

Filesize
8.1MB

Download
memory/1888-4-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download