ffa4ae1464fa5dfc507995b44a2c28fe12cd46150d17514a09cae6baf0c15543

Analysis

max time kernel
90s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
15-02-2023 20:21

Target

ffa4ae1464fa5dfc507995b44a2c28fe12cd46150d17514a09cae6baf0c15543.exe
Size

260KB
MD5

a8798f4f9da2238b36eb25f2608ab3b8
SHA1

99aa11d1b0b39ed451c86ae2d5f38e5d81057020
SHA256

ffa4ae1464fa5dfc507995b44a2c28fe12cd46150d17514a09cae6baf0c15543
SHA512

9e419975fe55e532f631ad994641d004ede25284c6389fe044f7ed6cd444cbfe133190af6e01a96470bdc2aa0934b60bf2ff27883a661c36323ffc57a6f7c79b
SSDEEP

6144:H3JQC0VFlepSs1xycRSAztVJvXulAC6kFZC5xKKV5kiKirLZv98:/Z1xhRVd2l6QZC715hKi5

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4092 4916 WerFault.exe ffa4ae1464fa5dfc507995b44a2c28fe12cd46150d17514a09cae6baf0c15543.exe

pid	pid_target	process	target process
4092	4916	WerFault.exe	ffa4ae1464fa5dfc507995b44a2c28fe12cd46150d17514a09cae6baf0c15543.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ffa4ae1464fa5dfc507995b44a2c28fe12cd46150d17514a09cae6baf0c15543.exe

pid	process
4916	ffa4ae1464fa5dfc507995b44a2c28fe12cd46150d17514a09cae6baf0c15543.exe
4916	ffa4ae1464fa5dfc507995b44a2c28fe12cd46150d17514a09cae6baf0c15543.exe

C:\Users\Admin\AppData\Local\Temp\ffa4ae1464fa5dfc507995b44a2c28fe12cd46150d17514a09cae6baf0c15543.exe
"C:\Users\Admin\AppData\Local\Temp\ffa4ae1464fa5dfc507995b44a2c28fe12cd46150d17514a09cae6baf0c15543.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 684
2⤵
- Program crash
PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4916 -ip 4916
1⤵
PID:636

memory/4916-132-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4916-133-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4916-134-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4916-135-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download