6a48664b1a7ee70d3b6bd549db717d0ae2e1dcfd06b83df575ca659f458e4f51

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:05

Target

6a48664b1a7ee70d3b6bd549db717d0ae2e1dcfd06b83df575ca659f458e4f51.exe
Size

491KB
MD5

d01df803597162e19f2e7468bcb9bed1
SHA1

ec1fc44c40fc1c02d039796d07f5e1637edbb0ff
SHA256

6a48664b1a7ee70d3b6bd549db717d0ae2e1dcfd06b83df575ca659f458e4f51
SHA512

714d6a94bc8cd2f229abd64f3c348b86d9f41c98d09c40d19c7663bc986450c1b2939bbac75ba9be8368be31240e37ee0d54334d541d896f5043f30603eeadb0
SSDEEP

12288:wReDFheiIiq0IeSy0WIj3sfa79KkDAFfw+e8i:wRe2ilyjVPj3bxUS

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2324 4664 WerFault.exe 6a48664b1a7ee70d3b6bd549db717d0ae2e1dcfd06b83df575ca659f458e4f51.exe

pid	pid_target	process	target process
2324	4664	WerFault.exe	6a48664b1a7ee70d3b6bd549db717d0ae2e1dcfd06b83df575ca659f458e4f51.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

6a48664b1a7ee70d3b6bd549db717d0ae2e1dcfd06b83df575ca659f458e4f51.exe

pid	process
4664	6a48664b1a7ee70d3b6bd549db717d0ae2e1dcfd06b83df575ca659f458e4f51.exe
4664	6a48664b1a7ee70d3b6bd549db717d0ae2e1dcfd06b83df575ca659f458e4f51.exe

C:\Users\Admin\AppData\Local\Temp\6a48664b1a7ee70d3b6bd549db717d0ae2e1dcfd06b83df575ca659f458e4f51.exe
"C:\Users\Admin\AppData\Local\Temp\6a48664b1a7ee70d3b6bd549db717d0ae2e1dcfd06b83df575ca659f458e4f51.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 600
2⤵
- Program crash
PID:2324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4664 -ip 4664
1⤵
PID:1076

memory/4664-132-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/4664-133-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download