4ce6f5b6bfc61a8a4a209699e9350d82d3dea797f62510c9f82f140df3027d10

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:22

Target

4ce6f5b6bfc61a8a4a209699e9350d82d3dea797f62510c9f82f140df3027d10.exe
Size

282KB
MD5

afb5c434971203b49eeb6fcdc0628959
SHA1

a526310823858272babf9e6e87ec338d788c9a0b
SHA256

4ce6f5b6bfc61a8a4a209699e9350d82d3dea797f62510c9f82f140df3027d10
SHA512

a82227cb5525191ab15ee1d1aa67665af8d0156de3cf8a8694c2c4036fd2dfb8bdf0d60fc063306583fe56da8129e7d66d0987bafd126202ab29024b99507d9b
SSDEEP

6144:uCdcF+JoOBrwtEcc6ozxm2xUfOflaswez:E+RBUjAm2xqYas1

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5112 448 WerFault.exe 4ce6f5b6bfc61a8a4a209699e9350d82d3dea797f62510c9f82f140df3027d10.exe

pid	pid_target	process	target process
5112	448	WerFault.exe	4ce6f5b6bfc61a8a4a209699e9350d82d3dea797f62510c9f82f140df3027d10.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

4ce6f5b6bfc61a8a4a209699e9350d82d3dea797f62510c9f82f140df3027d10.exe

pid	process
448	4ce6f5b6bfc61a8a4a209699e9350d82d3dea797f62510c9f82f140df3027d10.exe
448	4ce6f5b6bfc61a8a4a209699e9350d82d3dea797f62510c9f82f140df3027d10.exe
448	4ce6f5b6bfc61a8a4a209699e9350d82d3dea797f62510c9f82f140df3027d10.exe
448	4ce6f5b6bfc61a8a4a209699e9350d82d3dea797f62510c9f82f140df3027d10.exe

C:\Users\Admin\AppData\Local\Temp\4ce6f5b6bfc61a8a4a209699e9350d82d3dea797f62510c9f82f140df3027d10.exe
"C:\Users\Admin\AppData\Local\Temp\4ce6f5b6bfc61a8a4a209699e9350d82d3dea797f62510c9f82f140df3027d10.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 232
2⤵
- Program crash
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 448 -ip 448
1⤵
PID:1004