xehook | 17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 01:00

Target

17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe
Size

273KB
MD5

e795115169cc800de0392d6a675d58fd
SHA1

8dd75837e360ba1cb8acf5a3d348dd020a5da482
SHA256

17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e
SHA512

5fb6543e91de175bd365462a1cc87d6772e43b0effd3757b3e408b08a4de5a004de9a85e7f1d09578fa3bc6b6486c5f5016c1b879496582dbb39b2e62e168f38
SSDEEP

6144:s/wl9dobdtMJNPX459l2/FpnovRWf1RdSxWbkHg6O0:HdoRtMJRkQp2MY0QO0

Score

10^/10

xehook stealer

Detect Xehook Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2796-0-0x0000000001130000-0x0000000001178000-memory.dmp	family_xehook

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1688	2796	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 1688	2796	17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe	29
PID 2796 wrote to memory of 1688	2796	17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe	29
PID 2796 wrote to memory of 1688	2796	17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe	29
PID 2796 wrote to memory of 1688	2796	17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe	29

C:\Users\Admin\AppData\Local\Temp\17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe
"C:\Users\Admin\AppData\Local\Temp\17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 92
  2⤵
  - Program crash
  PID:1688

memory/2796-0-0x0000000001130000-0x0000000001178000-memory.dmp

Filesize
288KB

Download