f4c3fbcb0cb49eb172a787d7f28e9498314a4eb4e816adfdb1fe21442ab75eb3

Analysis

max time kernel
158s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:42

Target

f4c3fbcb0cb49eb172a787d7f28e9498314a4eb4e816adfdb1fe21442ab75eb3.exe
Size

328KB
MD5

366d97157eac76fd1e06a2845e24a5b1
SHA1

53374813284e934e7a57f590fbf44cd97a2af3ee
SHA256

f4c3fbcb0cb49eb172a787d7f28e9498314a4eb4e816adfdb1fe21442ab75eb3
SHA512

404fbbe5cfee174f2d21071d8bbc0e61ab1e9f69604b898f0645817e0f4655d21df0de2139b4bae76127c1384c39532e719f756d53d5e0310d552e6a2b4154d2
SSDEEP

6144:5NyF/LMHaCjQNiOKzHkVF8C+zV5qEiiYGZSVQg6GreDBSBcnTSbYqm:HytLCBkBKmF8TzkcEeQBGEm

Score

3^/10

Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4212	3488	WerFault.exe	f4c3fbcb0cb49eb172a787d7f28e9498314a4eb4e816adfdb1fe21442ab75eb3.exe
3880	3488	WerFault.exe	f4c3fbcb0cb49eb172a787d7f28e9498314a4eb4e816adfdb1fe21442ab75eb3.exe
1116	3488	WerFault.exe	f4c3fbcb0cb49eb172a787d7f28e9498314a4eb4e816adfdb1fe21442ab75eb3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

f4c3fbcb0cb49eb172a787d7f28e9498314a4eb4e816adfdb1fe21442ab75eb3.exe

pid	process
3488	f4c3fbcb0cb49eb172a787d7f28e9498314a4eb4e816adfdb1fe21442ab75eb3.exe
3488	f4c3fbcb0cb49eb172a787d7f28e9498314a4eb4e816adfdb1fe21442ab75eb3.exe

C:\Users\Admin\AppData\Local\Temp\f4c3fbcb0cb49eb172a787d7f28e9498314a4eb4e816adfdb1fe21442ab75eb3.exe
"C:\Users\Admin\AppData\Local\Temp\f4c3fbcb0cb49eb172a787d7f28e9498314a4eb4e816adfdb1fe21442ab75eb3.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 516
2⤵
- Program crash
PID:4212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 524
2⤵
- Program crash
PID:3880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 524
2⤵
- Program crash
PID:1116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3488 -ip 3488
1⤵
PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3488 -ip 3488
1⤵
PID:944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3488 -ip 3488
1⤵
PID:4252