c6fff6828393b4fcbdb662b2a0b7fe85879aeecd4f34b9b1f20e5d51a8da7261

Analysis

max time kernel
208s
max time network
227s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 05:18

Target

c6fff6828393b4fcbdb662b2a0b7fe85879aeecd4f34b9b1f20e5d51a8da7261.exe
Size

221KB
MD5

979aca3a0e5a1f06d2266be262ff9130
SHA1

40472f7573cc91313fcd3f025959d8c8c67ab1dd
SHA256

c6fff6828393b4fcbdb662b2a0b7fe85879aeecd4f34b9b1f20e5d51a8da7261
SHA512

f54c07383f1244779f93d94a354e97f921224e849e99e2ecc39b6a9e504dfea42fb4c85b4c634f720fe844d2b231edee4a772b7b2c6d79e1a7fbd34c8db3806c
SSDEEP

3072:zXT8bOA9OxjMGBg5xah9p06qDRoZ32BktfDI+0STbjXPa5QqnnhSiOuzcspefC:3A81Bg50pjmBKXpbjXrWnhauUfC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3192	3576	WerFault.exe	80

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3576	c6fff6828393b4fcbdb662b2a0b7fe85879aeecd4f34b9b1f20e5d51a8da7261.exe
3576	c6fff6828393b4fcbdb662b2a0b7fe85879aeecd4f34b9b1f20e5d51a8da7261.exe
3576	c6fff6828393b4fcbdb662b2a0b7fe85879aeecd4f34b9b1f20e5d51a8da7261.exe
3576	c6fff6828393b4fcbdb662b2a0b7fe85879aeecd4f34b9b1f20e5d51a8da7261.exe
3576	c6fff6828393b4fcbdb662b2a0b7fe85879aeecd4f34b9b1f20e5d51a8da7261.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
3576	c6fff6828393b4fcbdb662b2a0b7fe85879aeecd4f34b9b1f20e5d51a8da7261.exe
3576	c6fff6828393b4fcbdb662b2a0b7fe85879aeecd4f34b9b1f20e5d51a8da7261.exe
3576	c6fff6828393b4fcbdb662b2a0b7fe85879aeecd4f34b9b1f20e5d51a8da7261.exe
3576	c6fff6828393b4fcbdb662b2a0b7fe85879aeecd4f34b9b1f20e5d51a8da7261.exe
3576	c6fff6828393b4fcbdb662b2a0b7fe85879aeecd4f34b9b1f20e5d51a8da7261.exe

C:\Users\Admin\AppData\Local\Temp\c6fff6828393b4fcbdb662b2a0b7fe85879aeecd4f34b9b1f20e5d51a8da7261.exe
"C:\Users\Admin\AppData\Local\Temp\c6fff6828393b4fcbdb662b2a0b7fe85879aeecd4f34b9b1f20e5d51a8da7261.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 684
  2⤵
  - Program crash
  PID:3192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3576 -ip 3576
1⤵
PID:400

memory/3576-132-0x0000000000530000-0x0000000000534000-memory.dmp

Filesize
16KB

Download
memory/3576-133-0x0000000000530000-0x0000000000534000-memory.dmp

Filesize
16KB

Download