35664933c72627a9180e8bb7f279581d513eac6839d1e5942764e8fb8eb66233 | Triage

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 00:53

Sharing

Report Analysis Logs

General

Target

092af0baa16e6d618ab7dd1ce9813f3b.exe
Size

644KB
MD5

092af0baa16e6d618ab7dd1ce9813f3b
SHA1

8a909cd64b0d5957addb6f58f71386ae60df8be3
SHA256

35664933c72627a9180e8bb7f279581d513eac6839d1e5942764e8fb8eb66233
SHA512

116ef82ca283e3013a9fa85398ab6ad8057cc9609851a25a6ec269ba189d7c7292d8108f8fc14d81e54fd384b10e544b5e9551aa20c59233141ccb5c872a2023
SSDEEP

12288:1xs3Sbl7yCNYo16Hfv4ZZTbsdTwgILrfs3Sbl7yCNYX:ciR7G47eQLrkiR7+

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
640	1464	WerFault.exe	90

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1464	092af0baa16e6d618ab7dd1ce9813f3b.exe

C:\Users\Admin\AppData\Local\Temp\092af0baa16e6d618ab7dd1ce9813f3b.exe
"C:\Users\Admin\AppData\Local\Temp\092af0baa16e6d618ab7dd1ce9813f3b.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 464
  2⤵
  - Program crash
  PID:640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1464 -ip 1464
1⤵
PID:5112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads