5f02d11f87d53b8e02eb1a943c553c969dc80f57bad64fedd842b5607109a141

Analysis

max time kernel
124s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:05

Target

EXEPackager/EXEPackager.exe
Size

854KB
MD5

00bea0c049b0f25810b851058c472348
SHA1

5f18bb989a3eda8b46ea67ab54abe6eabc53ba6d
SHA256

c3521577fda7ec36c49d3c029d09fa48823a3cc7ccabbf75b5edfa7f20d8eb6c
SHA512

1a58b2eeaa13e8c6cfea68beeb6dde71879c32821bdfc9b58676876a850f29ad1921c88dda0f680b7f1df0abdea805d733ea482cd7461388eaab9fd90e54f1bc
SSDEEP

24576:Hp2ZKKY1Fz2dYF74iVsSfwwj1vpVYb9Z1vv72Yfn++lSZvPKX7:Ho2/SYF7dVsuj1vpavRj2SMZXKr

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1736 1592 WerFault.exe EXEPackager.exe
2872 1592 WerFault.exe EXEPackager.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

EXEPackager.exe

pid process

1592 EXEPackager.exe
1592 EXEPackager.exe
1592 EXEPackager.exe
1592 EXEPackager.exe

pid	pid_target	process	target process
1736	1592	WerFault.exe	EXEPackager.exe
2872	1592	WerFault.exe	EXEPackager.exe

C:\Users\Admin\AppData\Local\Temp\EXEPackager\EXEPackager.exe
"C:\Users\Admin\AppData\Local\Temp\EXEPackager\EXEPackager.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 536
2⤵
- Program crash
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 816
2⤵
- Program crash
PID:2872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1592 -ip 1592
1⤵
PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1592 -ip 1592
1⤵
PID:3392

memory/1592-132-0x0000000000400000-0x000000000067C000-memory.dmp

Filesize
2.5MB

Download
memory/1592-133-0x0000000000400000-0x000000000067C000-memory.dmp

Filesize
2.5MB

Download
memory/1592-135-0x0000000000400000-0x000000000067C000-memory.dmp

Filesize
2.5MB

Download