4c468204e49e353f62765cb19151d034ce24b23efb7d094f081495f68fb88cda

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14-03-2024 04:29

Target

c7b0f7e8c536b182802180e506def00e.exe
Size

2.3MB
MD5

c7b0f7e8c536b182802180e506def00e
SHA1

f05c2c479ccba292abaa8bacd62fd2b8098732c5
SHA256

4c468204e49e353f62765cb19151d034ce24b23efb7d094f081495f68fb88cda
SHA512

a8ac9d2af1970f9825a00cd6e336267805858fd930389dcf2c99db1aeb61921118ee9b9d6019214205575911e1196dbdf7a5b49e13ac940a1982cd9279d1ea8a
SSDEEP

49152:+SVU6vy1RYWmPXWXYE+R+1vnlrZff8pDmwPXYHTwf8E+4LgEVn:XFv8RpcWXTsKvlq/iTlE+Sgc

Score

3^/10

Program crash 6 IoCs

pid	pid_target	Process	procid_target
2868	4564	WerFault.exe	87
4736	4564	WerFault.exe	87
3604	4564	WerFault.exe	87
4976	4564	WerFault.exe	87
5052	4564	WerFault.exe	87
4168	4564	WerFault.exe	87

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4564	c7b0f7e8c536b182802180e506def00e.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4564	c7b0f7e8c536b182802180e506def00e.exe

C:\Users\Admin\AppData\Local\Temp\c7b0f7e8c536b182802180e506def00e.exe
"C:\Users\Admin\AppData\Local\Temp\c7b0f7e8c536b182802180e506def00e.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 348
  2⤵
  - Program crash
  PID:2868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 860
  2⤵
  - Program crash
  PID:4736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 880
  2⤵
  - Program crash
  PID:3604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 888
  2⤵
  - Program crash
  PID:4976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 868
  2⤵
  - Program crash
  PID:5052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 892
  2⤵
  - Program crash
  PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4564 -ip 4564
1⤵
PID:1440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4564 -ip 4564
1⤵
PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4564 -ip 4564
1⤵
PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4564 -ip 4564
1⤵
PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4564 -ip 4564
1⤵
PID:1436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4564 -ip 4564
1⤵
PID:3076

memory/4564-0-0x0000000000E50000-0x00000000010EA000-memory.dmp

Filesize
2.6MB

Download
memory/4564-3-0x0000000000E50000-0x00000000010EA000-memory.dmp

Filesize
2.6MB

Download
memory/4564-6-0x0000000000E50000-0x00000000010EA000-memory.dmp

Filesize
2.6MB

Download
memory/4564-16-0x0000000000E50000-0x00000000010EA000-memory.dmp

Filesize
2.6MB

Download