6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2023 20:27

Target

6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395.exe
Size

466KB
MD5

afc4e290c87a14c777274f8d0207efbe
SHA1

522da5899c8d93d84142664f8d57054a16ffcdf0
SHA256

6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395
SHA512

fa03b8ff34ce28d417f40d0720329b072d6bdaf2473857b0492fd16fa7a11921daebd8e5d76f18973bd635d5e6b07698120280c9c632f9f20e4041e5ad4f482f
SSDEEP

12288:RBmcc97rfYIAeaL358TyQszy0JZXyQ583meHPs:3G97rpg35JEQi6pg

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2184 3496 WerFault.exe 6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395.exe

pid process

3496 6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395.exe

pid	pid_target	process	target process
2184	3496	WerFault.exe	6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395.exe

pid	process
3496	6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395.exe

C:\Users\Admin\AppData\Local\Temp\6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395.exe
"C:\Users\Admin\AppData\Local\Temp\6ee3586d1a4b5a4f0c42b2028491442e92bb27d81330d84db8d066677527a395.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 824
  2⤵
  - Program crash
  PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 3496 -ip 3496
1⤵
PID:804

memory/3496-132-0x0000000000400000-0x0000000000AD3000-memory.dmp

Filesize
6.8MB

Download
memory/3496-134-0x0000000000400000-0x0000000000AD3000-memory.dmp

Filesize
6.8MB

Download
memory/3496-135-0x0000000000400000-0x0000000000AD3000-memory.dmp

Filesize
6.8MB

Download
memory/3496-136-0x0000000000400000-0x0000000000AD3000-memory.dmp

Filesize
6.8MB

Download