93c6be3d0b5cc28942fc2e54b2f2171c257124b5024504969e4e9847a62c9a9f

Analysis

max time kernel
202s
max time network
212s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:15

Target

93c6be3d0b5cc28942fc2e54b2f2171c257124b5024504969e4e9847a62c9a9f.exe
Size

150KB
MD5

60f287d80ff20904a0eddc36e07f5acf
SHA1

591a24adb19bb0447fdabd8eb7aabbb3c2f4b711
SHA256

93c6be3d0b5cc28942fc2e54b2f2171c257124b5024504969e4e9847a62c9a9f
SHA512

9f0d965790b4a8ed45dd0feb4121543b03be3bb3e80025f7ef513c999e37b985070c864f30ca3dceea218d765fa1dc55f31ed234278d8160df0657ccac2ccb5c
SSDEEP

3072:60qvw3Bi8juQNFqQw50HwlMBBBL5xDI9oRgKfoMo:SSshQbhw56BQ92gs

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3408 3440 WerFault.exe 93c6be3d0b5cc28942fc2e54b2f2171c257124b5024504969e4e9847a62c9a9f.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

93c6be3d0b5cc28942fc2e54b2f2171c257124b5024504969e4e9847a62c9a9f.exe

pid process

3440 93c6be3d0b5cc28942fc2e54b2f2171c257124b5024504969e4e9847a62c9a9f.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

93c6be3d0b5cc28942fc2e54b2f2171c257124b5024504969e4e9847a62c9a9f.exe

pid process

3440 93c6be3d0b5cc28942fc2e54b2f2171c257124b5024504969e4e9847a62c9a9f.exe

pid	pid_target	process	target process
3408	3440	WerFault.exe	93c6be3d0b5cc28942fc2e54b2f2171c257124b5024504969e4e9847a62c9a9f.exe

pid	process
3440	93c6be3d0b5cc28942fc2e54b2f2171c257124b5024504969e4e9847a62c9a9f.exe

pid	process
3440	93c6be3d0b5cc28942fc2e54b2f2171c257124b5024504969e4e9847a62c9a9f.exe

C:\Users\Admin\AppData\Local\Temp\93c6be3d0b5cc28942fc2e54b2f2171c257124b5024504969e4e9847a62c9a9f.exe
"C:\Users\Admin\AppData\Local\Temp\93c6be3d0b5cc28942fc2e54b2f2171c257124b5024504969e4e9847a62c9a9f.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
PID:3440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 452
  2⤵
  - Program crash
  PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3440 -ip 3440
1⤵
PID:4480

memory/3440-132-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/3440-133-0x0000000002250000-0x000000000226D000-memory.dmp

Filesize
116KB

Download
memory/3440-134-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/3440-135-0x0000000002250000-0x000000000226D000-memory.dmp

Filesize
116KB

Download