9aa293eaf7a59ecd7359c5ad700d50cef8fee1bd9f4d92831abda3f74226e31c

Analysis

Target
9aa293eaf7a59ecd7359c5ad700d50cef8fee1bd9f4d92831abda3f74226e31c.exe
Size 597KB
Sample220520-hx8qcsfbc8
SHA256 9aa293eaf7a59ecd7359c5ad700d50cef8fee1bd9f4d92831abda3f74226e31c
MD5 701132d3579a9ad10a166bc9642dd3fc
SHA1 2f8e0017bd626ee6a14e12768265aad7aa9e9051
SHA512 3c4ba95363398b3eac415f33eaea14abf3c54b71862cbc39d7ff5141a0464a46630a161d217215f6669ef469435ff46236bcca61584109fd4cfe7d0a78e1db1a
MD5 SHA1 SHA512

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9JhQji1C.url	9aa293eaf7a59ecd7359c5ad700d50cef8fee1bd9f4d92831abda3f74226e31c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9JhQji1C.url	9aa293eaf7a59ecd7359c5ad700d50cef8fee1bd9f4d92831abda3f74226e31c.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4964	2600	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\9aa293eaf7a59ecd7359c5ad700d50cef8fee1bd9f4d92831abda3f74226e31c.exe
"C:\Users\Admin\AppData\Local\Temp\9aa293eaf7a59ecd7359c5ad700d50cef8fee1bd9f4d92831abda3f74226e31c.exe"
1⤵
- Drops startup file
PID:2600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 8980
  2⤵
  - Program crash
  PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2600 -ip 2600
1⤵
PID:4472

memory/2600-130-0x00000000004A0000-0x000000000053C000-memory.dmp

Download

memory/2600-131-0x0000000005470000-0x0000000005A14000-memory.dmp

Download

memory/2600-132-0x0000000004EC0000-0x0000000005464000-memory.dmp

Download