8656a1e44687b27c574313c94c7d822a335bfeac64343bd809d78a060b49039d

Analysis

max time kernel
154s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 13:59

Target

8656a1e44687b27c574313c94c7d822a335bfeac64343bd809d78a060b49039d.exe
Size

441KB
MD5

111deea1d1ee2405e8cdf670b807a300
SHA1

d94fe3681cc0ffd3b4ad9592f38e539ef44cca07
SHA256

8656a1e44687b27c574313c94c7d822a335bfeac64343bd809d78a060b49039d
SHA512

4a3f51d91ebdf29f67c1e78ad8efea9dcf9e366437213be76e46f4e15167df163e4d0f732f6b2480b102ba436b527ada3f3afefbd044a538745f99921eadf04b
SSDEEP

6144:z/9xthw6eD3h/iI1UUjT3pZNFzg9R+sweu2ubSmqDA8U/TIf0SqT:z/3tbeD3h/N1jpZNi9R+swevu2LDA8K

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
228	1232	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1232	8656a1e44687b27c574313c94c7d822a335bfeac64343bd809d78a060b49039d.exe
1232	8656a1e44687b27c574313c94c7d822a335bfeac64343bd809d78a060b49039d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1232	8656a1e44687b27c574313c94c7d822a335bfeac64343bd809d78a060b49039d.exe

C:\Users\Admin\AppData\Local\Temp\8656a1e44687b27c574313c94c7d822a335bfeac64343bd809d78a060b49039d.exe
"C:\Users\Admin\AppData\Local\Temp\8656a1e44687b27c574313c94c7d822a335bfeac64343bd809d78a060b49039d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 552
  2⤵
  - Program crash
  PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1232 -ip 1232
1⤵
PID:3292