056fa68696efe1581b3f41e980912edb08c603edcd250a5eebb25ae36ed8e283

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 05:23

Target

056fa68696efe1581b3f41e980912edb08c603edcd250a5eebb25ae36ed8e283.exe
Size

3.9MB
MD5

0b74c56d206a728dde75a0c1510adfa4
SHA1

a7cab21ac1d184e50b5c3bc713104e10daa738fb
SHA256

056fa68696efe1581b3f41e980912edb08c603edcd250a5eebb25ae36ed8e283
SHA512

a333944c0a151789c02910b5146a862706fd025f2b4fe89159039fbd8feb4d9c6c0e7485890d0885327134e7b2f2a64413c53a2dbf938024a292fbe686ab8935
SSDEEP

98304:LYxAC9tFZKYJbaPwgxlM1MDtYA+JqaD1N:LYH1KYJbaogxqMDOAcDH

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2892	056fa68696efe1581b3f41e980912edb08c603edcd250a5eebb25ae36ed8e283.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	2892	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2892	056fa68696efe1581b3f41e980912edb08c603edcd250a5eebb25ae36ed8e283.exe
2892	056fa68696efe1581b3f41e980912edb08c603edcd250a5eebb25ae36ed8e283.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 1708	2892	056fa68696efe1581b3f41e980912edb08c603edcd250a5eebb25ae36ed8e283.exe	28
PID 2892 wrote to memory of 1708	2892	056fa68696efe1581b3f41e980912edb08c603edcd250a5eebb25ae36ed8e283.exe	28
PID 2892 wrote to memory of 1708	2892	056fa68696efe1581b3f41e980912edb08c603edcd250a5eebb25ae36ed8e283.exe	28
PID 2892 wrote to memory of 1708	2892	056fa68696efe1581b3f41e980912edb08c603edcd250a5eebb25ae36ed8e283.exe	28

C:\Users\Admin\AppData\Local\Temp\056fa68696efe1581b3f41e980912edb08c603edcd250a5eebb25ae36ed8e283.exe
"C:\Users\Admin\AppData\Local\Temp\056fa68696efe1581b3f41e980912edb08c603edcd250a5eebb25ae36ed8e283.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 324
  2⤵
  - Program crash
  PID:1708

\Users\Admin\AppData\Local\Temp\f76205c.tmp

Filesize
333KB

MD5
56a2bcecbd3cddd6f4a35361bf4920d6

SHA1
992e63be423f0e61093ba183f49fc0cbec790488

SHA256
5fcfac18758a12e0e717a5189f379922a32b5ac12f26491e638d70b54ae1dcab

SHA512
473cbdf760242db1f0f1d0c27046c0564998f2bf931ad03feb28af3c7bd253d00e6f0836dadf37f29e0db4171eb64e6a15ed4cb9a9d28b48fb0aab601573f551

Download Submit
memory/2892-3-0x0000000061080000-0x0000000061119000-memory.dmp

Filesize
612KB

Download