1392247c76d540d644faa3258e8610e458c99767cc70f5e9d35b9b88dcf7a5cc

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 06:59

Target

d57c958fafc872e16d4c328b1a287ba1.exe
Size

1.5MB
MD5

d57c958fafc872e16d4c328b1a287ba1
SHA1

a1c821881c170411f66d33dc08677953cd68473b
SHA256

1392247c76d540d644faa3258e8610e458c99767cc70f5e9d35b9b88dcf7a5cc
SHA512

b1eaf959493ec6aa8e950587d21a9e03d8a8b0a9825afa202adf188bdc62f62cc2d39237d1f1cee52c862c8466e46f2321d80fc43de9d44cc3d902f0d4073488
SSDEEP

49152:QZsd3KhjodH8+HAC12qbDOV2DZBvIzEL2PAr:QZsd3DEGBv6RPw

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2276	d57c958fafc872e16d4c328b1a287ba1.exe
2276	d57c958fafc872e16d4c328b1a287ba1.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2860	2276	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2276	d57c958fafc872e16d4c328b1a287ba1.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2276	d57c958fafc872e16d4c328b1a287ba1.exe
2276	d57c958fafc872e16d4c328b1a287ba1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2860	2276	d57c958fafc872e16d4c328b1a287ba1.exe	28
PID 2276 wrote to memory of 2860	2276	d57c958fafc872e16d4c328b1a287ba1.exe	28
PID 2276 wrote to memory of 2860	2276	d57c958fafc872e16d4c328b1a287ba1.exe	28
PID 2276 wrote to memory of 2860	2276	d57c958fafc872e16d4c328b1a287ba1.exe	28

C:\Users\Admin\AppData\Local\Temp\d57c958fafc872e16d4c328b1a287ba1.exe
"C:\Users\Admin\AppData\Local\Temp\d57c958fafc872e16d4c328b1a287ba1.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 344
  2⤵
  - Program crash
  PID:2860

memory/2276-0-0x0000000000400000-0x0000000000802000-memory.dmp

Filesize
4.0MB

Download
memory/2276-1-0x0000000077430000-0x0000000077431000-memory.dmp

Filesize
4KB

Download
memory/2276-3-0x0000000077430000-0x0000000077431000-memory.dmp

Filesize
4KB

Download
memory/2276-5-0x0000000077430000-0x0000000077431000-memory.dmp

Filesize
4KB

Download
memory/2276-7-0x0000000077430000-0x0000000077431000-memory.dmp

Filesize
4KB

Download
memory/2276-9-0x0000000077430000-0x0000000077431000-memory.dmp

Filesize
4KB

Download
memory/2276-11-0x0000000077430000-0x0000000077431000-memory.dmp

Filesize
4KB

Download
memory/2276-13-0x0000000077430000-0x0000000077431000-memory.dmp

Filesize
4KB

Download
memory/2276-15-0x0000000077430000-0x0000000077431000-memory.dmp

Filesize
4KB

Download
memory/2276-18-0x0000000000400000-0x0000000000802000-memory.dmp

Filesize
4.0MB

Download
memory/2276-17-0x00000000772BF000-0x00000000772C0000-memory.dmp

Filesize
4KB

Download
memory/2276-19-0x00000000772C0000-0x00000000772C1000-memory.dmp

Filesize
4KB

Download
memory/2276-21-0x0000000077430000-0x0000000077431000-memory.dmp

Filesize
4KB

Download
memory/2276-22-0x00000000002D0000-0x0000000000314000-memory.dmp

Filesize
272KB

Download
memory/2276-27-0x00000000002D0000-0x0000000000314000-memory.dmp

Filesize
272KB

Download
memory/2276-28-0x0000000000400000-0x0000000000802000-memory.dmp

Filesize
4.0MB

Download