fc2d29f2566a416d0f3b3c717fe09a1f4cbc00e6fb41e338b39067ddfb3c9a1d

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 05:15

Target

fc2d29f2566a416d0f3b3c717fe09a1f4cbc00e6fb41e338b39067ddfb3c9a1d.exe
Size

1.1MB
MD5

2704a0dac11c09d51111274bf6cb397f
SHA1

397bfca354f1be809f88a18f16f78c8cc8dbd668
SHA256

fc2d29f2566a416d0f3b3c717fe09a1f4cbc00e6fb41e338b39067ddfb3c9a1d
SHA512

e1d777032348bf57b7b380c6f56db0c25a3e11f04931e5c626d53b384cb392b39ce5fbf36f3caf9a84794a8dbdf4e90bc87911b4c8b058060ceb14992bc614cc
SSDEEP

24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Q3kiu5N:CcaClSFlG4ZM7Q3M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2044	3048	WerFault.exe	27

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3048	fc2d29f2566a416d0f3b3c717fe09a1f4cbc00e6fb41e338b39067ddfb3c9a1d.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3048	fc2d29f2566a416d0f3b3c717fe09a1f4cbc00e6fb41e338b39067ddfb3c9a1d.exe
3048	fc2d29f2566a416d0f3b3c717fe09a1f4cbc00e6fb41e338b39067ddfb3c9a1d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2044	3048	fc2d29f2566a416d0f3b3c717fe09a1f4cbc00e6fb41e338b39067ddfb3c9a1d.exe	28
PID 3048 wrote to memory of 2044	3048	fc2d29f2566a416d0f3b3c717fe09a1f4cbc00e6fb41e338b39067ddfb3c9a1d.exe	28
PID 3048 wrote to memory of 2044	3048	fc2d29f2566a416d0f3b3c717fe09a1f4cbc00e6fb41e338b39067ddfb3c9a1d.exe	28
PID 3048 wrote to memory of 2044	3048	fc2d29f2566a416d0f3b3c717fe09a1f4cbc00e6fb41e338b39067ddfb3c9a1d.exe	28

C:\Users\Admin\AppData\Local\Temp\fc2d29f2566a416d0f3b3c717fe09a1f4cbc00e6fb41e338b39067ddfb3c9a1d.exe
"C:\Users\Admin\AppData\Local\Temp\fc2d29f2566a416d0f3b3c717fe09a1f4cbc00e6fb41e338b39067ddfb3c9a1d.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 336
  2⤵
  - Program crash
  PID:2044

memory/3048-0-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download