4761183bc8bff993a5551916eda73c84bb8f9eadd24c4c19587045bb91609a83

Analysis

max time kernel
76s
max time network
147s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
18/10/2022, 02:41

Target

4761183bc8bff993a5551916eda73c84bb8f9eadd24c4c19587045bb91609a83.exe
Size

397KB
MD5

c751af3a2b5e5085e0cf4a66a09480d9
SHA1

0d451c8ee760d3fdf1233b44b657dc10e0450bb6
SHA256

4761183bc8bff993a5551916eda73c84bb8f9eadd24c4c19587045bb91609a83
SHA512

bd88ea76db942b4fd865ed986be75d6df6a90d10f3600a4c3f330a0d7935b1906b536a2eb2cc0211dd199bf2a37440d0a8febbbe6c6ad9b9027e6e59c9511e01
SSDEEP

12288:n5RmQFpKMFeO7Blp/B8Z7QZLJZpT6672GbziER839l/d6LYE2B38jqLX:Z/l839l/ooEC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3800	2664	WerFault.exe	65

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
1152	NOTEPAD.EXE

C:\Users\Admin\AppData\Local\Temp\4761183bc8bff993a5551916eda73c84bb8f9eadd24c4c19587045bb91609a83.exe
"C:\Users\Admin\AppData\Local\Temp\4761183bc8bff993a5551916eda73c84bb8f9eadd24c4c19587045bb91609a83.exe"
1⤵
PID:2664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 196
  2⤵
  - Program crash
  PID:3800

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log
1⤵
- Opens file in notepad (likely ransom note)
PID:1152

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3056

memory/2664-115-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-116-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-117-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-118-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download