c449badad7f61736b70ee6d94b0702b83d2060b3e8b1d9586a74428376c1e8a6

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 12:19

Target

c899d1c30be6ff205cf8e05ae15fe5d9.exe
Size

32KB
MD5

c899d1c30be6ff205cf8e05ae15fe5d9
SHA1

e29b05e9de3be6bb08716628a382affdc9b3b89e
SHA256

c449badad7f61736b70ee6d94b0702b83d2060b3e8b1d9586a74428376c1e8a6
SHA512

0f337fbf85aa3e16e5516d4606065b61b9238575945a1e47762e0edd498a94908bd7afc0167293feea2b3723aad7d0508d32b0e1784fedbd1c2d8ccdab961e26
SSDEEP

768:TbKKKq2xt9gGRVDna6be+Lp6yemNc356d:3Lx2z9gJmLccd

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3128	2924	WerFault.exe	87
2168	2924	WerFault.exe	87
2460	2924	WerFault.exe	87

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2924	c899d1c30be6ff205cf8e05ae15fe5d9.exe

C:\Users\Admin\AppData\Local\Temp\c899d1c30be6ff205cf8e05ae15fe5d9.exe
"C:\Users\Admin\AppData\Local\Temp\c899d1c30be6ff205cf8e05ae15fe5d9.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 736
  2⤵
  - Program crash
  PID:3128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 736
  2⤵
  - Program crash
  PID:2168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 732
  2⤵
  - Program crash
  PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2924 -ip 2924
1⤵
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2924 -ip 2924
1⤵
PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2924 -ip 2924
1⤵
PID:2040