34de67f81b75cade438d5891dac3ad7c6efc0a49f811801dde24d583d8e2c3b8

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 20:19

Target

34de67f81b75cade438d5891dac3ad7c6efc0a49f811801dde24d583d8e2c3b8.exe
Size

184KB
MD5

26efea45f6b2467713b97f08ff1d53f7
SHA1

b579da982a342c380e754d020f84e062b7f5f637
SHA256

34de67f81b75cade438d5891dac3ad7c6efc0a49f811801dde24d583d8e2c3b8
SHA512

d17b095316e1b01d342ede98317d704b50c9a43a2c300a48a02670970501ec37c1863d229a12a158ce718ade2e4ebd6e9211c94f4cd98d60c3c9a51db59034b2
SSDEEP

3072:8knVtponVBqwdwLcJNG8X2aglvnqsviua:8kto6swLT8GaglPqsviu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1984	2084	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2084	34de67f81b75cade438d5891dac3ad7c6efc0a49f811801dde24d583d8e2c3b8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1984	2084	34de67f81b75cade438d5891dac3ad7c6efc0a49f811801dde24d583d8e2c3b8.exe	28
PID 2084 wrote to memory of 1984	2084	34de67f81b75cade438d5891dac3ad7c6efc0a49f811801dde24d583d8e2c3b8.exe	28
PID 2084 wrote to memory of 1984	2084	34de67f81b75cade438d5891dac3ad7c6efc0a49f811801dde24d583d8e2c3b8.exe	28
PID 2084 wrote to memory of 1984	2084	34de67f81b75cade438d5891dac3ad7c6efc0a49f811801dde24d583d8e2c3b8.exe	28

C:\Users\Admin\AppData\Local\Temp\34de67f81b75cade438d5891dac3ad7c6efc0a49f811801dde24d583d8e2c3b8.exe
"C:\Users\Admin\AppData\Local\Temp\34de67f81b75cade438d5891dac3ad7c6efc0a49f811801dde24d583d8e2c3b8.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 240
  2⤵
  - Program crash
  PID:1984