1f70fc60687591d5ff2e7fe3dc460e80d8a0478f935885683a4eee1d1e97a0bd

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 16:58

Target

1f70fc60687591d5ff2e7fe3dc460e80d8a0478f935885683a4eee1d1e97a0bd.exe
Size

5.8MB
MD5

fa7fa2d7565c8444e201214b4f979d2c
SHA1

411b27b756809992dbdcb29042037b92939ddac7
SHA256

1f70fc60687591d5ff2e7fe3dc460e80d8a0478f935885683a4eee1d1e97a0bd
SHA512

75ad72235d4344b66971e0fcb03d0ac257d146a71eb1841a37aa3c4c26012b3111c7d33050ba773610fa99aa0cb6c3c30d01bafe8ad43b5c0767c0cdc9e0cd88
SSDEEP

98304:ky/lybei/B///uGcKfjmFns+8Y4uZpl6CNXUa7V1/qSAPNodl/U+hiSotgnr:Ty/p/uBFfn6STtZHU+hz

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1124	2364	WerFault.exe	87
3588	2364	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2364	1f70fc60687591d5ff2e7fe3dc460e80d8a0478f935885683a4eee1d1e97a0bd.exe
2364	1f70fc60687591d5ff2e7fe3dc460e80d8a0478f935885683a4eee1d1e97a0bd.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2364	1f70fc60687591d5ff2e7fe3dc460e80d8a0478f935885683a4eee1d1e97a0bd.exe

C:\Users\Admin\AppData\Local\Temp\1f70fc60687591d5ff2e7fe3dc460e80d8a0478f935885683a4eee1d1e97a0bd.exe
"C:\Users\Admin\AppData\Local\Temp\1f70fc60687591d5ff2e7fe3dc460e80d8a0478f935885683a4eee1d1e97a0bd.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 356
  2⤵
  - Program crash
  PID:1124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 436
  2⤵
  - Program crash
  PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2364 -ip 2364
1⤵
PID:1120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2364 -ip 2364
1⤵
PID:4532

memory/2364-0-0x0000000000400000-0x0000000000D35000-memory.dmp

Filesize
9.2MB

Download
memory/2364-1-0x0000000001D90000-0x0000000001D91000-memory.dmp

Filesize
4KB

Download
memory/2364-2-0x0000000000400000-0x0000000000D35000-memory.dmp

Filesize
9.2MB

Download
memory/2364-3-0x0000000000400000-0x0000000000D35000-memory.dmp

Filesize
9.2MB

Download
memory/2364-6-0x0000000000400000-0x0000000000D35000-memory.dmp

Filesize
9.2MB

Download