3a96804abab07a21d666a9c9b5b5f432e15eff747cc8bdff150fedc6bd2866bf

Analysis

max time kernel
160s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 03:23

Target

3a96804abab07a21d666a9c9b5b5f432e15eff747cc8bdff150fedc6bd2866bf.exe
Size

80KB
MD5

ba91a824889c17ba6d003a297f13ed72
SHA1

919efea7cc6da12eafd74cc4ce6c7a536f9cefb4
SHA256

3a96804abab07a21d666a9c9b5b5f432e15eff747cc8bdff150fedc6bd2866bf
SHA512

4e1b65fc77f3ec5b46ab1f28b283685daa00aca363a725bfede637cfffc3772035d49153dcf78e974978f8e6335376445d20c8c860af793f1dc34384ab747981
SSDEEP

768:7BUFoJQyIbLKsU2CSv/D3RDSOBUFoJQyIbLKsU2CSv/D3RDSp:7goJvsUn2LRuOgoJvsUn2LRup

Score

4^/10

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\tcount.bak	3a96804abab07a21d666a9c9b5b5f432e15eff747cc8bdff150fedc6bd2866bf.exe
File created	C:\Program Files\3a96804abab07a21d666a9c9b5b5f432e15eff747cc8bdff150fedc6bd2866bf.exe	3a96804abab07a21d666a9c9b5b5f432e15eff747cc8bdff150fedc6bd2866bf.exe
File opened for modification	C:\Program Files\3a96804abab07a21d666a9c9b5b5f432e15eff747cc8bdff150fedc6bd2866bf.exe	3a96804abab07a21d666a9c9b5b5f432e15eff747cc8bdff150fedc6bd2866bf.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5016	3164	WerFault.exe	81

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3164	3a96804abab07a21d666a9c9b5b5f432e15eff747cc8bdff150fedc6bd2866bf.exe
3164	3a96804abab07a21d666a9c9b5b5f432e15eff747cc8bdff150fedc6bd2866bf.exe
3164	3a96804abab07a21d666a9c9b5b5f432e15eff747cc8bdff150fedc6bd2866bf.exe

C:\Users\Admin\AppData\Local\Temp\3a96804abab07a21d666a9c9b5b5f432e15eff747cc8bdff150fedc6bd2866bf.exe
"C:\Users\Admin\AppData\Local\Temp\3a96804abab07a21d666a9c9b5b5f432e15eff747cc8bdff150fedc6bd2866bf.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 1176
  2⤵
  - Program crash
  PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3164 -ip 3164
1⤵
PID:444