94e33a27796bbb0b084ba834dc220cf7769d9448967ebd8719acda60998077ac

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 07:00

Target

0d42c9fbd4be381550ad0bf19e511668.exe
Size

121KB
MD5

0d42c9fbd4be381550ad0bf19e511668
SHA1

ee851257ba30851d2d149f1d803f7d8dfe9d2daa
SHA256

94e33a27796bbb0b084ba834dc220cf7769d9448967ebd8719acda60998077ac
SHA512

a648f46e88d0378e0e444c11ebb1ca77e26bb492f8521a1eec791352142056a50451b6c3a08f30a5c81a09e7b2b846fbec1628549795f47a09ddb28bfd96c4c5
SSDEEP

3072:NXvvRDNzgfAtykj7Y4GMSxNmyEsH5DFHEjrTznBt:N/JBzntnjbGPxNmyXH5RQ1t

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2920	2132	WerFault.exe	15

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2132	0d42c9fbd4be381550ad0bf19e511668.exe
2132	0d42c9fbd4be381550ad0bf19e511668.exe

C:\Users\Admin\AppData\Local\Temp\0d42c9fbd4be381550ad0bf19e511668.exe
"C:\Users\Admin\AppData\Local\Temp\0d42c9fbd4be381550ad0bf19e511668.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 640
  2⤵
  - Program crash
  PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 2132 -ip 2132
1⤵
PID:3804

memory/2132-0-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2132-2-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2132-1-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/2132-3-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download