3ef1859ebbb41cd6a8facee2d46382f24fa79594986fe4e8b43f94b703e64e86

Analysis

max time kernel
91s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:07

Target

3ef1859ebbb41cd6a8facee2d46382f24fa79594986fe4e8b43f94b703e64e86.exe
Size

37KB
MD5

44f894f9e34668dae57c55cf39687a30
SHA1

25fd50f31ff16711f24bbf890c13bf67987acf3a
SHA256

3ef1859ebbb41cd6a8facee2d46382f24fa79594986fe4e8b43f94b703e64e86
SHA512

72d12f9d1e41932fffacd77d74940e3c3cb7baa8e7f75fdf55a55a61f136f2a79a636af421fac2a51d530ae7979ff743582b002f057e706ac0f079374b17991c
SSDEEP

384:lhnWyf0UiT3rj9AOfxjDNpVFnZWQ8J7rCClRhmtpi0iJigZO9JSPXXkrMxD9Ymkq:lh5ct/CORwQ8VCROgb8fHxWVee

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2080 4960 WerFault.exe 3ef1859ebbb41cd6a8facee2d46382f24fa79594986fe4e8b43f94b703e64e86.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3ef1859ebbb41cd6a8facee2d46382f24fa79594986fe4e8b43f94b703e64e86.exe

pid process

4960 3ef1859ebbb41cd6a8facee2d46382f24fa79594986fe4e8b43f94b703e64e86.exe

pid	pid_target	process	target process
2080	4960	WerFault.exe	3ef1859ebbb41cd6a8facee2d46382f24fa79594986fe4e8b43f94b703e64e86.exe

pid	process
4960	3ef1859ebbb41cd6a8facee2d46382f24fa79594986fe4e8b43f94b703e64e86.exe

C:\Users\Admin\AppData\Local\Temp\3ef1859ebbb41cd6a8facee2d46382f24fa79594986fe4e8b43f94b703e64e86.exe
"C:\Users\Admin\AppData\Local\Temp\3ef1859ebbb41cd6a8facee2d46382f24fa79594986fe4e8b43f94b703e64e86.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 464
2⤵
- Program crash
PID:2080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4960 -ip 4960
1⤵
PID:984