639c687a35392623696ff79d7f8d35919fbd1240707e787b5bc5b035efcaba5d

Analysis

max time kernel
156s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 04:20

Target

639c687a35392623696ff79d7f8d35919fbd1240707e787b5bc5b035efcaba5d.exe
Size

424KB
MD5

9e76fc45e01464f800ed82ee21c24ab6
SHA1

02559ed78227f3569b1cc202ff37ef49c1448efe
SHA256

639c687a35392623696ff79d7f8d35919fbd1240707e787b5bc5b035efcaba5d
SHA512

6746fe9f1814eb2ff4149cff5a382899d6dd2ddebbef7c5e1bcb89a18bd8ccfc386cc64fff4d431f2b94b1d143471ad296eb8868106181e6e29801ae73bcc8f9
SSDEEP

12288:dkdGr8Vezlmi3lHbI2MBTad+sp/jK9wb+Ha:udGr8qlmi9bI2LdrpLo6O

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4976	2288	WerFault.exe	78

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2288	639c687a35392623696ff79d7f8d35919fbd1240707e787b5bc5b035efcaba5d.exe

C:\Users\Admin\AppData\Local\Temp\639c687a35392623696ff79d7f8d35919fbd1240707e787b5bc5b035efcaba5d.exe
"C:\Users\Admin\AppData\Local\Temp\639c687a35392623696ff79d7f8d35919fbd1240707e787b5bc5b035efcaba5d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 900
  2⤵
  - Program crash
  PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2288 -ip 2288
1⤵
PID:1512

memory/2288-132-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/2288-133-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download