f9b6a3aa9f190358be763f5bc08a44a8eb7d5412b3ac3eb0490e919d9e1fca83

Analysis

max time kernel
152s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 19:12

Target

f9b6a3aa9f190358be763f5bc08a44a8eb7d5412b3ac3eb0490e919d9e1fca83.exe
Size

248KB
MD5

968aa71bc85acbe80fd6021680d2247d
SHA1

dddb690db20ef641582968d93e4963270d946c56
SHA256

f9b6a3aa9f190358be763f5bc08a44a8eb7d5412b3ac3eb0490e919d9e1fca83
SHA512

fdf5e5fe5a17127f8d2ca653aecf83f9745e8872890b84736b25106befb4a69d151aa6059f40a3626ae1a063060827b2ffeeb0a18fef13c96bdb04c7dd8763d3
SSDEEP

6144:UYAUWh6S9N95hQDku5CFfqxqJsZttcSZtl3:U6IX2MQqqZttdZtB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1980	4608	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4608	f9b6a3aa9f190358be763f5bc08a44a8eb7d5412b3ac3eb0490e919d9e1fca83.exe
4608	f9b6a3aa9f190358be763f5bc08a44a8eb7d5412b3ac3eb0490e919d9e1fca83.exe
4608	f9b6a3aa9f190358be763f5bc08a44a8eb7d5412b3ac3eb0490e919d9e1fca83.exe
4608	f9b6a3aa9f190358be763f5bc08a44a8eb7d5412b3ac3eb0490e919d9e1fca83.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4608	f9b6a3aa9f190358be763f5bc08a44a8eb7d5412b3ac3eb0490e919d9e1fca83.exe

C:\Users\Admin\AppData\Local\Temp\f9b6a3aa9f190358be763f5bc08a44a8eb7d5412b3ac3eb0490e919d9e1fca83.exe
"C:\Users\Admin\AppData\Local\Temp\f9b6a3aa9f190358be763f5bc08a44a8eb7d5412b3ac3eb0490e919d9e1fca83.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:4608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 416
  2⤵
  - Program crash
  PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4608 -ip 4608
1⤵
PID:4604