7882eab29859c18474d3674f7802e17c2c78616f3dc9c5afbba04bd30db1b213

Analysis

max time kernel
6s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 19:03

Target

CAD迷你画图/DWGGallery.exe
Size

1.2MB
MD5

773dc516e20193225dec5903e9eb7d89
SHA1

6b42a649b96a57e325e1f255919319a997675083
SHA256

e8ca4b3f5128a55e33f9113e77fccb9d445daf8a6532f544cafdedacf471ce28
SHA512

6164c80de7ba133cad050492d5c885461c31ff28f6f4cf7fd5e4087e869ea793e3c1a02d3744d2aa230f302fab2069f0e6c8644cc5c26f9e4d8d37f59be843d5
SSDEEP

12288:frvHEu+Owl0bAj+DjxQoQ9xEpqaSaXaHaUsaHa0i5po9:T/3cj+ZQoQ9xEpqaSaXaHaUsaHa00pu

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2224	2908	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

DWGGallery.exe

pid	Process
2908	DWGGallery.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

DWGGallery.exe

description	pid	Process	procid_target
PID 2908 wrote to memory of 2224	2908	DWGGallery.exe	29
PID 2908 wrote to memory of 2224	2908	DWGGallery.exe	29
PID 2908 wrote to memory of 2224	2908	DWGGallery.exe	29
PID 2908 wrote to memory of 2224	2908	DWGGallery.exe	29

C:\Users\Admin\AppData\Local\Temp\CAD迷你画图\DWGGallery.exe
"C:\Users\Admin\AppData\Local\Temp\CAD迷你画图\DWGGallery.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 212
  2⤵
  - Program crash
  PID:2224