16d90becedc8db98707d9959052f4e686066eab7ae751b1582016602d5208600

Analysis

max time kernel
91s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17/12/2022, 18:43

Target
file.exe
Size 1.5MB
Sample221217-xcwmmaca2v
SHA256 16d90becedc8db98707d9959052f4e686066eab7ae751b1582016602d5208600
MD5 8dab57b143d9d0e3e6e9fb7e907be6f5
SHA1 05665881e724b93c2677f40570c9ac52b137d610
SHA512 ab7abd22bc3fd351056e3c1ea4cb270acb3d2a4ae581c6f7c490ac515324eaf84647d089fe3ff72a0d20a5ccc60765acae84a96b91852ea80e1858b559c5d4a7
SSDEEP 24576:0HfxQEhFjWFBb5tSBbnnZn+itZ5w0RfS8Ec1gC9W1q2UwlVmA:0/Bh4BbWdnZ+cZ5d9Ek9vJsVmA
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4596	3712	WerFault.exe	78

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3712	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 268
  2⤵
  - Program crash
  PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3712 -ip 3712
1⤵
PID:2688