be310f452503b00cb82e17dfa344458c7f9f8ec4996df17048a6aecfacc7e27e

Analysis

max time kernel
50s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2022 22:37

Target

be310f452503b00cb82e17dfa344458c7f9f8ec4996df17048a6aecfacc7e27e.exe
Size

264KB
MD5

6d094e4990d9693df1565db96816a217
SHA1

4d73f8582129a6e195bebb0458dc397a2281521d
SHA256

be310f452503b00cb82e17dfa344458c7f9f8ec4996df17048a6aecfacc7e27e
SHA512

649561310b8a359666b15510d20d3d4a963ce5c71ab526eef7e44edabd4de984a09428757edff6335efd4b525a7717c98d526012b7767b7c966e7fa4eb6aed0a
SSDEEP

6144:93HFgeeNMPaZRupn+aZGVXpEqI2JX6gAy/AwM:9UEc8B+XLEqIeX6gAy/c

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
5052	be310f452503b00cb82e17dfa344458c7f9f8ec4996df17048a6aecfacc7e27emgr.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4632	5052	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 5052	1200	be310f452503b00cb82e17dfa344458c7f9f8ec4996df17048a6aecfacc7e27e.exe	82
PID 1200 wrote to memory of 5052	1200	be310f452503b00cb82e17dfa344458c7f9f8ec4996df17048a6aecfacc7e27e.exe	82
PID 1200 wrote to memory of 5052	1200	be310f452503b00cb82e17dfa344458c7f9f8ec4996df17048a6aecfacc7e27e.exe	82

C:\Users\Admin\AppData\Local\Temp\be310f452503b00cb82e17dfa344458c7f9f8ec4996df17048a6aecfacc7e27e.exe
"C:\Users\Admin\AppData\Local\Temp\be310f452503b00cb82e17dfa344458c7f9f8ec4996df17048a6aecfacc7e27e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\be310f452503b00cb82e17dfa344458c7f9f8ec4996df17048a6aecfacc7e27emgr.exe
  C:\Users\Admin\AppData\Local\Temp\be310f452503b00cb82e17dfa344458c7f9f8ec4996df17048a6aecfacc7e27emgr.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 384
    3⤵
    - Program crash
    PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5052 -ip 5052
1⤵
PID:4932

C:\Users\Admin\AppData\Local\Temp\be310f452503b00cb82e17dfa344458c7f9f8ec4996df17048a6aecfacc7e27emgr.exe

Filesize
192KB

MD5
72864b90643b2ff7a3e4c06b03ad2ce7

SHA1
52f60736728362514dec7880f67009408bf744da

SHA256
c0dc483d5d52f102a46125ba7b79757cf535aaf6075ff1bf0b255243d0b88c43

SHA512
b6f2abb30dedc588601324a203f348f453443a28de2a82b16ae175621471126680bf239e502e5c4f848955a6031e211976a3aa24eaa9e1e56b06c30916a23bf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\be310f452503b00cb82e17dfa344458c7f9f8ec4996df17048a6aecfacc7e27emgr.exe

Filesize
192KB

MD5
72864b90643b2ff7a3e4c06b03ad2ce7

SHA1
52f60736728362514dec7880f67009408bf744da

SHA256
c0dc483d5d52f102a46125ba7b79757cf535aaf6075ff1bf0b255243d0b88c43

SHA512
b6f2abb30dedc588601324a203f348f453443a28de2a82b16ae175621471126680bf239e502e5c4f848955a6031e211976a3aa24eaa9e1e56b06c30916a23bf2

Download Submit
memory/1200-132-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1200-136-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download