35439e9e062d34f293d426bf178c57bec3cc618bfa1c37db0627b66d885926ea

Analysis

max time kernel
155s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 10:21

Target

cdce3e32e9637426e790e00b88b0760d.exe
Size

8.6MB
MD5

cdce3e32e9637426e790e00b88b0760d
SHA1

36238a5ed4fbf2a9c843da303e4332b8ad1ec746
SHA256

35439e9e062d34f293d426bf178c57bec3cc618bfa1c37db0627b66d885926ea
SHA512

5d31cb2cd6268f1e344081a5a1b7f868cb4508fceb1f555f4a7fe361a6d5f6f52827c0c79c2dff40510d1771beadbebb389d0e2a72247e266f0a9d5921681134
SSDEEP

98304:q3WIosGshkzIJYHKvbruN6Q6BYCmA5RnEqgHUGtln1dZaoKAvtsGiZq2X:qcsGshXcgOTD1/aoK4wZq2X

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4812	372	WerFault.exe	97
2708	372	WerFault.exe	97

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
372	cdce3e32e9637426e790e00b88b0760d.exe
372	cdce3e32e9637426e790e00b88b0760d.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 372 wrote to memory of 2304	372	cdce3e32e9637426e790e00b88b0760d.exe	105
PID 372 wrote to memory of 2304	372	cdce3e32e9637426e790e00b88b0760d.exe	105
PID 372 wrote to memory of 4812	372	cdce3e32e9637426e790e00b88b0760d.exe	117
PID 372 wrote to memory of 4812	372	cdce3e32e9637426e790e00b88b0760d.exe	117
PID 372 wrote to memory of 4812	372	cdce3e32e9637426e790e00b88b0760d.exe	117

C:\Users\Admin\AppData\Local\Temp\cdce3e32e9637426e790e00b88b0760d.exe
"C:\Users\Admin\AppData\Local\Temp\cdce3e32e9637426e790e00b88b0760d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:372
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 1528
  2⤵
  - Program crash
  PID:4812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 1528
  2⤵
  - Program crash
  PID:2708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 372 -ip 372
1⤵
PID:940

memory/372-0-0x0000000000400000-0x0000000000C15000-memory.dmp

Filesize
8.1MB

Download
memory/372-1-0x0000000002B60000-0x0000000002B61000-memory.dmp

Filesize
4KB

Download
memory/372-2-0x0000000000400000-0x0000000000C15000-memory.dmp

Filesize
8.1MB

Download
memory/372-3-0x0000000000400000-0x0000000000C15000-memory.dmp

Filesize
8.1MB

Download
memory/372-4-0x0000000002B60000-0x0000000002B61000-memory.dmp

Filesize
4KB

Download
memory/372-5-0x0000000000400000-0x0000000000C15000-memory.dmp

Filesize
8.1MB

Download
memory/372-7-0x0000000000400000-0x0000000000C15000-memory.dmp

Filesize
8.1MB

Download
memory/372-9-0x0000000000400000-0x0000000000C15000-memory.dmp

Filesize
8.1MB

Download