020d26b25d0ff279f57900988c1d459bb87f0be3f79f69e7736f522b3f06f250

Analysis

max time kernel
95s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 01:31

Target

ShellQMaker1.2/Loading.exe
Size

11.4MB
MD5

fb68d69f6560ba6b9c2fb34302484088
SHA1

ed4122eccd96a02fbd50f72b7378f3bef27b8c6c
SHA256

fe7cdb2791d59e8606ea588bb22fc7f0d4e17f40f66aae4b8f41d86f14c0869e
SHA512

0c6d2d64e38465892a12744adb0d142987041505375ab2bad895f4e9f09221f23886a4aec908a0e9cf991838e5845159626b394a1282a45f63b75a7aad5be0d6
SSDEEP

196608:Jua9H1n4YZUIeeiVJsv6tWKFdu9CY+7f:xy9VJsv6tWKFdu9Cx

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
628	4328	WerFault.exe	85
3984	4328	WerFault.exe	85
3820	4328	WerFault.exe	85

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4328	Loading.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4328	Loading.exe

C:\Users\Admin\AppData\Local\Temp\ShellQMaker1.2\Loading.exe
"C:\Users\Admin\AppData\Local\Temp\ShellQMaker1.2\Loading.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 728
  2⤵
  - Program crash
  PID:628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 736
  2⤵
  - Program crash
  PID:3984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 752
  2⤵
  - Program crash
  PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4328 -ip 4328
1⤵
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4328 -ip 4328
1⤵
PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4328 -ip 4328
1⤵
PID:1572