28a3f03175ef882efd2f09c30d3e9dc0ef697981bf7d1e6406182b29b0638c18

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 23:34

Target

202e21a574b8b7626b6486ed63babcc8.exe
Size

1.4MB
MD5

202e21a574b8b7626b6486ed63babcc8
SHA1

47a007c14aed21487457954787c61327408d997f
SHA256

28a3f03175ef882efd2f09c30d3e9dc0ef697981bf7d1e6406182b29b0638c18
SHA512

a9fe475bf0ff903a251a7ce71b7cd94497b4d08677189d91bca6143962afa81da86ee91067ed4e115442e5e63d81cf0caf99ea02c23af588539fe7a85701cbad
SSDEEP

24576:cwf4pwQvRHW/nSYZEnnQ3v0lJyhH2kobswtFD5i6dMHo5dsNJd1yFSt:oplvR2/SYenQcJy1GJFM6dX/6JdT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3152	1480	WerFault.exe	16

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1480	202e21a574b8b7626b6486ed63babcc8.exe
1480	202e21a574b8b7626b6486ed63babcc8.exe

C:\Users\Admin\AppData\Local\Temp\202e21a574b8b7626b6486ed63babcc8.exe
"C:\Users\Admin\AppData\Local\Temp\202e21a574b8b7626b6486ed63babcc8.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 720
  2⤵
  - Program crash
  PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1480 -ip 1480
1⤵
PID:1484

memory/1480-0-0x0000000000400000-0x00000000007BA000-memory.dmp

Filesize
3.7MB

Download
memory/1480-4-0x0000000000400000-0x00000000007BA000-memory.dmp

Filesize
3.7MB

Download