3f3bb30bd4ad6c4c4dc873e571615ebe770d0dbde63852f2c69f52154b38a44f

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 15:48

Target

de5fa97599c27399b1e5523110bced0a.exe
Size

226KB
MD5

de5fa97599c27399b1e5523110bced0a
SHA1

8edfc1d75ed2fcdaf22cbba3190a207895a66ba3
SHA256

3f3bb30bd4ad6c4c4dc873e571615ebe770d0dbde63852f2c69f52154b38a44f
SHA512

f7909ed14a2dd220a88bc14f56f860835d7a7475e35248fc4ece883465e7a97fe08a7cfb43752c66ddb561bb42ee880a02c48e03f65736f50d405dec609275ec
SSDEEP

6144:CyG5vA3FmFA5U0sJSSDBCgdna2vQtxIMZHUFev4S:Gq3vUrhDIKjQZHUYAS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2416	1692	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1692	de5fa97599c27399b1e5523110bced0a.exe
1692	de5fa97599c27399b1e5523110bced0a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2416	1692	de5fa97599c27399b1e5523110bced0a.exe	28
PID 1692 wrote to memory of 2416	1692	de5fa97599c27399b1e5523110bced0a.exe	28
PID 1692 wrote to memory of 2416	1692	de5fa97599c27399b1e5523110bced0a.exe	28
PID 1692 wrote to memory of 2416	1692	de5fa97599c27399b1e5523110bced0a.exe	28

C:\Users\Admin\AppData\Local\Temp\de5fa97599c27399b1e5523110bced0a.exe
"C:\Users\Admin\AppData\Local\Temp\de5fa97599c27399b1e5523110bced0a.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 304
  2⤵
  - Program crash
  PID:2416

memory/1692-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1692-1-0x0000000000220000-0x0000000000258000-memory.dmp

Filesize
224KB

Download
memory/1692-3-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1692-2-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1692-4-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1692-6-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download