010004ad2ee0c1bdb7b6ce2a572053db7184567dc9454d68109f7c94058ad1b0

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 14:56

Target

BoanPackUp.exe
Size

356KB
MD5

93099e15a15ac737c403d9a17254965d
SHA1

131f591a1f1b891b673a7d51b8dfe7612c64f81d
SHA256

2899130a7979422da5d17982633ee57cd23fcfbd43f93c3ac71f558bee77d4d1
SHA512

d2caac077143608cef5e48ca582865a2cc03c7dfb7037b929870315061638872324677da7212df93ba2da43c42664c8f7c77734f8675f5d1c68fdbf9c25ac23f
SSDEEP

3072:jIveE/XvCY7I9Ssmok7eSmc+5af8OkXjWo6Z7YaLpmWAXrf359sPJ/vtKfgs8hCp:jI9/XV7nok7mc+5c8OKGCKwgs/H

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1688	2888	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2888	BoanPackUp.exe
2888	BoanPackUp.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 1688	2888	BoanPackUp.exe	28
PID 2888 wrote to memory of 1688	2888	BoanPackUp.exe	28
PID 2888 wrote to memory of 1688	2888	BoanPackUp.exe	28
PID 2888 wrote to memory of 1688	2888	BoanPackUp.exe	28

C:\Users\Admin\AppData\Local\Temp\BoanPackUp.exe
"C:\Users\Admin\AppData\Local\Temp\BoanPackUp.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 228
  2⤵
  - Program crash
  PID:1688