983748c25d0701763e2d22718371bc136838148f1d0918778906da5d52617f26

Analysis

max time kernel
131s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2023 12:39

Target

1/内容.exe
Size

167KB
MD5

b30d517585fefa8cd92a0af9d3193b87
SHA1

716cc624c33e168adfecab2a0d26f1af2526fdd2
SHA256

22ab670f9dcaf146d719e864fc3e01b0f5bd4d587834366c8b5dcd78f677f310
SHA512

fd8c0f629cdaf963d0d592edc591efdae75e922664cca552d4b1ab08d416f52aa534fbb5e4ca0f5d8a22f40d68933e92201296942e41bb57da39b778bb55e394
SSDEEP

3072:lQUcrL6KmL783vtpkBAoH66Gop/q/rQms3cp6L8EcSufWr7+tvZZsXILNeujvcu2:lQfSKm/6kBoRop/q/rQm6k6QEcSzr6tk

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3444 4740 WerFault.exe 内容.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

内容.exe

pid process

4740 内容.exe
4740 内容.exe

pid	pid_target	process	target process
3444	4740	WerFault.exe	内容.exe

pid	process
4740	内容.exe
4740	内容.exe

C:\Users\Admin\AppData\Local\Temp\1\内容.exe
"C:\Users\Admin\AppData\Local\Temp\1\内容.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 1236
2⤵
- Program crash
PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4740 -ip 4740
1⤵
PID:2688