65853b239ba6b6d2abd0698c1528b00d6bdbf38be3a29a016bf943a9f3e94966

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2023 07:42

Target

4672-153-0x0000000000600000-0x0000000000A89000-memory.exe
Size

4.5MB
MD5

efefb6319ff161306b5c385fe2a6fff6
SHA1

a7088fea1e5f0cf0e5959bd5659a54cddc2258a4
SHA256

65853b239ba6b6d2abd0698c1528b00d6bdbf38be3a29a016bf943a9f3e94966
SHA512

afa0db46c5fa6ed1c3f8aeddd8c4392c9ddf8355a4b7b3079de39c54f390402c047a789acc4d7abd63c1172cc1159c9c0e50f851ecf999bb0c2eaf260b4f475b
SSDEEP

49152:mesKFWeVy5qD1SmQLkuEsCV+83uj+hH5Uz1OviFpK:meaAXULREFV+v+x5URXv

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1604 368 WerFault.exe 4672-153-0x0000000000600000-0x0000000000A89000-memory.exe

pid	pid_target	process	target process
1604	368	WerFault.exe	4672-153-0x0000000000600000-0x0000000000A89000-memory.exe

C:\Users\Admin\AppData\Local\Temp\4672-153-0x0000000000600000-0x0000000000A89000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\4672-153-0x0000000000600000-0x0000000000A89000-memory.exe"
1⤵
PID:368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 192
2⤵
- Program crash
PID:1604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 368 -ip 368
1⤵
PID:756