5c7e848b3b5bf1bc511ff2701f6ea0215b4ebb7581aa3e41b200115eebb676d4

Analysis

max time kernel
91s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2022 08:53

Target

892-69-0x0000000000400000-0x0000000000472000-memory.exe
Size

456KB
MD5

b45e6f14f7744c1432221c99c88e9aa3
SHA1

880d90876f3e194671c4cbc769c837f4606bb6a5
SHA256

5c7e848b3b5bf1bc511ff2701f6ea0215b4ebb7581aa3e41b200115eebb676d4
SHA512

56fdf387856c2aa4dc05675e900549d9b70cb5d0558550e97f46865ba7c45fcf663f095f78b3eae0e3c2623820c5f4c31d421f8699ea7b697f8943ce7a274a4a
SSDEEP

12288:5WnxfgsRL4u/1AlLK6FRY2n8OPKxGvYmB:GxgsRftD0C2nKG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1656	4800	WerFault.exe	80

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4800	892-69-0x0000000000400000-0x0000000000472000-memory.exe

C:\Users\Admin\AppData\Local\Temp\892-69-0x0000000000400000-0x0000000000472000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\892-69-0x0000000000400000-0x0000000000472000-memory.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 464
  2⤵
  - Program crash
  PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4800 -ip 4800
1⤵
PID:4876