f0fe1973b02b65c8f7db3f8d365c5fe260413006f79c337a9e19e08bc60b97fc

Analysis

max time kernel
138s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 23:47

Target

f0fe1973b02b65c8f7db3f8d365c5fe260413006f79c337a9e19e08bc60b97fc.exe
Size

634KB
MD5

53013ccc854ae9811242aeb9e8021f90
SHA1

dd895e294808781f02c144822ff552b91e1280a6
SHA256

f0fe1973b02b65c8f7db3f8d365c5fe260413006f79c337a9e19e08bc60b97fc
SHA512

f6703a5e094d50c9158a6925409f073a20ef9ea6034a84f57add5d8b535d16bbb832acb58f1b8137e93f101c31d50902fd0b74cbd7826466c30991ab9da74377
SSDEEP

12288:aYJzx7YJzxEYJzxnYJzxolYJ0iAor6e0ti1JHuZo:5JKJVJCJNJ0iAorwt/C

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4248 3696 WerFault.exe f0fe1973b02b65c8f7db3f8d365c5fe260413006f79c337a9e19e08bc60b97fc.exe

pid	pid_target	process	target process
4248	3696	WerFault.exe	f0fe1973b02b65c8f7db3f8d365c5fe260413006f79c337a9e19e08bc60b97fc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

f0fe1973b02b65c8f7db3f8d365c5fe260413006f79c337a9e19e08bc60b97fc.exe

pid	process
3696	f0fe1973b02b65c8f7db3f8d365c5fe260413006f79c337a9e19e08bc60b97fc.exe
3696	f0fe1973b02b65c8f7db3f8d365c5fe260413006f79c337a9e19e08bc60b97fc.exe
3696	f0fe1973b02b65c8f7db3f8d365c5fe260413006f79c337a9e19e08bc60b97fc.exe
3696	f0fe1973b02b65c8f7db3f8d365c5fe260413006f79c337a9e19e08bc60b97fc.exe

C:\Users\Admin\AppData\Local\Temp\f0fe1973b02b65c8f7db3f8d365c5fe260413006f79c337a9e19e08bc60b97fc.exe
"C:\Users\Admin\AppData\Local\Temp\f0fe1973b02b65c8f7db3f8d365c5fe260413006f79c337a9e19e08bc60b97fc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 492
2⤵
- Program crash
PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3696 -ip 3696
1⤵
PID:4088

memory/3696-132-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3696-133-0x0000000002160000-0x000000000217E000-memory.dmp

Filesize
120KB

Download