b0e6fffaadcf0cb1838663e92b24ccf99576cf892f039790eda56726e4728649

Analysis

max time kernel
76s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04/03/2023, 21:12

Target

b0e6fffaadcf0cb1838663e92b24ccf99576cf892f039790eda56726e4728649.exe
Size

3.1MB
MD5

e09364dce939c334e335f59fd0c60172
SHA1

7943222ffb8052fefaad67a4d530aabb5bdac4e9
SHA256

b0e6fffaadcf0cb1838663e92b24ccf99576cf892f039790eda56726e4728649
SHA512

dea89432c5243f4f46091a7b5b2b48fbf6aff01962e79a802233f1cd97d092af74f1fa23b7fcc67a0cb4af0c129e9e687e9851550e52ed1ff42e520a5e358131
SSDEEP

49152:POXEIlvI+tVMuRIWDvo0aFUxNgO3K2QtMzMD48hfoNtUFhZ6HBdAETEijNJgc:2jzfcFM3K2QtMQc8hQIFOHBgij

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2800	2548	WerFault.exe	83
32	2548	WerFault.exe	83

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2548	b0e6fffaadcf0cb1838663e92b24ccf99576cf892f039790eda56726e4728649.exe
2548	b0e6fffaadcf0cb1838663e92b24ccf99576cf892f039790eda56726e4728649.exe
2548	b0e6fffaadcf0cb1838663e92b24ccf99576cf892f039790eda56726e4728649.exe
2548	b0e6fffaadcf0cb1838663e92b24ccf99576cf892f039790eda56726e4728649.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2548	b0e6fffaadcf0cb1838663e92b24ccf99576cf892f039790eda56726e4728649.exe
2548	b0e6fffaadcf0cb1838663e92b24ccf99576cf892f039790eda56726e4728649.exe
2548	b0e6fffaadcf0cb1838663e92b24ccf99576cf892f039790eda56726e4728649.exe
2548	b0e6fffaadcf0cb1838663e92b24ccf99576cf892f039790eda56726e4728649.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2548	b0e6fffaadcf0cb1838663e92b24ccf99576cf892f039790eda56726e4728649.exe
2548	b0e6fffaadcf0cb1838663e92b24ccf99576cf892f039790eda56726e4728649.exe

C:\Users\Admin\AppData\Local\Temp\b0e6fffaadcf0cb1838663e92b24ccf99576cf892f039790eda56726e4728649.exe
"C:\Users\Admin\AppData\Local\Temp\b0e6fffaadcf0cb1838663e92b24ccf99576cf892f039790eda56726e4728649.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 684
  2⤵
  - Program crash
  PID:2800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 684
  2⤵
  - Program crash
  PID:32

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2548 -ip 2548
1⤵
PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2548 -ip 2548
1⤵
PID:812