052a5567c296c269b9dddc83cd13255f1f4d9c108e496d05336edce51bac00f9

Analysis

max time kernel
105s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 09:43

Target

745e38700525058503b34289888a6a02.exe
Size

629KB
MD5

745e38700525058503b34289888a6a02
SHA1

ba003df6d16eb891993d37284122d4edf7e9b36f
SHA256

052a5567c296c269b9dddc83cd13255f1f4d9c108e496d05336edce51bac00f9
SHA512

319aa6e61f523269023f11f0f73768e97eafb46fb1a049918ebe2a5857893749f94093aa1301800d907fbf0480d0322e7bc4657dac3f2bf16835fea1bdb60bde
SSDEEP

12288:dr5Z96PJF3B8TvZACcSQZhZhZkZTRtcSIB1PpjjbHR/CliB+1iC9hk7B/bY9Qfu:/Zyl/CNS7xY2u

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5100	5056	WerFault.exe	85

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
5056	745e38700525058503b34289888a6a02.exe

C:\Users\Admin\AppData\Local\Temp\745e38700525058503b34289888a6a02.exe
"C:\Users\Admin\AppData\Local\Temp\745e38700525058503b34289888a6a02.exe"
1⤵
- Suspicious use of UnmapMainImage
PID:5056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 556
  2⤵
  - Program crash
  PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5056 -ip 5056
1⤵
PID:4240

memory/5056-0-0x0000000000580000-0x000000000059F000-memory.dmp

Filesize
124KB

Download
memory/5056-1-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/5056-2-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download