12929390a651ac7c15cf63fd3444fd2ad5be77119477eb2ca00f3e2a23ed7ff7

Analysis

max time kernel
142s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 07:50

Target

4fff00dc13551eb29ab27915430fb8de.exe
Size

633KB
MD5

4fff00dc13551eb29ab27915430fb8de
SHA1

1f13041d2f345b89de0882d1f76312d17bd11aa4
SHA256

12929390a651ac7c15cf63fd3444fd2ad5be77119477eb2ca00f3e2a23ed7ff7
SHA512

32ac7faafa2c9cbeadb1dcc84085f0ddb8f9db52014a66b8802fc21d4d7ca130623b82948c07b8249c865c33ae535da170306f51c6211209220019313d53461f
SSDEEP

6144:TXHCDYMlCkfZAKL5BaE+/3b80UCHxJcAJFTcztv1twj/38qQNRe6C6CbzdMHYFqm:TXiDjCAt5BinHcAj+mb8/M6C6Cb9x

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5092	4460	WerFault.exe	14

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4460	4fff00dc13551eb29ab27915430fb8de.exe

C:\Users\Admin\AppData\Local\Temp\4fff00dc13551eb29ab27915430fb8de.exe
"C:\Users\Admin\AppData\Local\Temp\4fff00dc13551eb29ab27915430fb8de.exe"
1⤵
- Suspicious use of UnmapMainImage
PID:4460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 552
  2⤵
  - Program crash
  PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4460 -ip 4460
1⤵
PID:4432

memory/4460-0-0x00000000020B0000-0x00000000020CF000-memory.dmp

Filesize
124KB

Download
memory/4460-1-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4460-2-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download