6eed9e803c9a3279c5f1d97df326e7c6fc169d6495a27c84bce368dbca15f0b8

Analysis

max time kernel
66s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/12/2022, 00:49

Target
file.exe
Size 1.4MB
Sample221221-a6cehsbd42
SHA256 6eed9e803c9a3279c5f1d97df326e7c6fc169d6495a27c84bce368dbca15f0b8
MD5 ff08997fd579e8e1a3401587600117b3
SHA1 b92920d7a63c7a7ce52e038bae57469de8bd0d3d
SHA512 a85589e5c17ac93aa3351cd547c71de52f813634aa6696f8917dc7a2119c55ceeea80801343084c842bf32f8b6ebeb8cb93832d45a277d737c0ed91476495400
SSDEEP 24576:MCU0ZPWQ8zNgS9JLgqazoDaL+gBBO2xLlAN/UEswJmD41:MCU0ZPp8zNgS9JLgPkDaagBBO2V2N/Ue
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2928	3300	WerFault.exe	81

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3300	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3300 -s 376
  2⤵
  - Program crash
  PID:2928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3300 -ip 3300
1⤵
PID:4824