33a79bab45596814d10322226c6b2ea5219a5be7affb75cee8e1df6f45f19994

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 18:08

Target

0aa2df505742b67f798c3db8c659cb05.exe
Size

100KB
MD5

0aa2df505742b67f798c3db8c659cb05
SHA1

04f12544189c44ea35e0faf346505dc3329a474b
SHA256

33a79bab45596814d10322226c6b2ea5219a5be7affb75cee8e1df6f45f19994
SHA512

56c87190bb108c93ef96cc2969b5381a881d8f820ede9f4896ccd7b261f4e1b3aefcc4ebedc9e290e0ea9fe1726541d277a21e2849b4238e0775fed35239385a
SSDEEP

1536:vVg8iAuismyws8vLw0wF9MGM9K/oKtNgCMbA1bL3N+NM5UfONIjnZG+:y8v/KLOM5FCnQ+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3840	2564	WerFault.exe	87

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2564	0aa2df505742b67f798c3db8c659cb05.exe

C:\Users\Admin\AppData\Local\Temp\0aa2df505742b67f798c3db8c659cb05.exe
"C:\Users\Admin\AppData\Local\Temp\0aa2df505742b67f798c3db8c659cb05.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 464
  2⤵
  - Program crash
  PID:3840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2564 -ip 2564
1⤵
PID:4092

memory/2564-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2564-3-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download