488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665

Analysis

max time kernel
153s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 08:29

Target

488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe
Size

218KB
MD5

86bd5b1a7cdc9ff4bed366b70d079099
SHA1

0640d8923bae8025daa01c18a3cca33d998fb50b
SHA256

488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665
SHA512

b5b42249db27c254f61d0f807758ff4c8a7fb46832b185bebd2481fd456fe9830260b4d1ad4d49b57b4d7d0781aae7b0c1adb56b8bbe47239869e6e9e8893d63
SSDEEP

3072:jmhDbwbLVXEQCM4e3KCpKKXNlDr/8N1ZEK4ZLK2SeyhoK3kGqyDkIf6fG2WxxpBv:Sh/wVBCZhZKLgeLKteyt9wIf+SV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3512	1988	WerFault.exe	81

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{405CD8B9-3E65-4BB0-875D-A3B8247D6EE5}	488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{405CD8B9-3E65-4BB0-875D-A3B8247D6EE5}\	488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1988	488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe
1988	488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe

C:\Users\Admin\AppData\Local\Temp\488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe
"C:\Users\Admin\AppData\Local\Temp\488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 512
  2⤵
  - Program crash
  PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1988 -ip 1988
1⤵
PID:1920