517cb827b4727f02182954f911afdc1941baca8ba811e8f9be52d5d1a044ac76

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2024 12:27

Target

5675812ab00decc7dd4ea27cd22cd98b.exe
Size

178KB
MD5

5675812ab00decc7dd4ea27cd22cd98b
SHA1

5fafd0f90e100d562321ddb51fcb21eb8adef576
SHA256

517cb827b4727f02182954f911afdc1941baca8ba811e8f9be52d5d1a044ac76
SHA512

468321768e0db7ab99e93b84216ab6b10850ce1bfa8adbc8c5168276ae6f480a5e602e435a8299028215c050a2308a187b5faa7f37c003f219ea6558f8438d01
SSDEEP

3072:vawFVZVyuiwiOas97N7I+WipOS85v6iu0G1dy+1ZVdAEdvttaxIEzSf9Nn+WuO6K:vawFVZ0xjc97N7IBiCB6Vhg+TVdAAjIG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2792	1012	WerFault.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1012	5675812ab00decc7dd4ea27cd22cd98b.exe
1012	5675812ab00decc7dd4ea27cd22cd98b.exe

C:\Users\Admin\AppData\Local\Temp\5675812ab00decc7dd4ea27cd22cd98b.exe
"C:\Users\Admin\AppData\Local\Temp\5675812ab00decc7dd4ea27cd22cd98b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 688
  2⤵
  - Program crash
  PID:2792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1012 -ip 1012
1⤵
PID:4080

memory/1012-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1012-2-0x0000000000720000-0x0000000000820000-memory.dmp

Filesize
1024KB

Download
memory/1012-3-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1012-5-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download