76dc91d44204d5e3bd81ad18c529e04a224a3e0f36a6a55ad00cbbc76491b93e

Analysis

max time kernel
148s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2022 20:00

Target

76dc91d44204d5e3bd81ad18c529e04a224a3e0f36a6a55ad00cbbc76491b93e.exe
Size

84KB
MD5

83a9035da6c0996341e0d09b334b1c80
SHA1

fcfc33505ebaec321d3764d965695016394e8c26
SHA256

76dc91d44204d5e3bd81ad18c529e04a224a3e0f36a6a55ad00cbbc76491b93e
SHA512

b2a2eeb682da5cb0e9c6429b8eec984d20137ab9d7ed78d2252721960234976d790b1d0aadc70d95a47d966697e04b570d10fd2ad1a6f9cb9bc8a497b5435b37
SSDEEP

1536:ZRqYWQw6G+F6WWzSqtmQLgyx8+i9ghvmq+tlTsWkwLHGN/6kY:PWd6jWLmaHIddGpu

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
1932	76dc91d44204d5e3bd81ad18c529e04a224a3e0f36a6a55ad00cbbc76491b93e.exe
1932	76dc91d44204d5e3bd81ad18c529e04a224a3e0f36a6a55ad00cbbc76491b93e.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\01E668C5.dll	76dc91d44204d5e3bd81ad18c529e04a224a3e0f36a6a55ad00cbbc76491b93e.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\01E668C5.dll	76dc91d44204d5e3bd81ad18c529e04a224a3e0f36a6a55ad00cbbc76491b93e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\01E668C5.dat	76dc91d44204d5e3bd81ad18c529e04a224a3e0f36a6a55ad00cbbc76491b93e.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\01E668C5.dat	76dc91d44204d5e3bd81ad18c529e04a224a3e0f36a6a55ad00cbbc76491b93e.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Help\wshmcepts.chm	76dc91d44204d5e3bd81ad18c529e04a224a3e0f36a6a55ad00cbbc76491b93e.exe
File opened for modification	C:\Windows\Help\wshmcepts.chm	76dc91d44204d5e3bd81ad18c529e04a224a3e0f36a6a55ad00cbbc76491b93e.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4036	1932	WerFault.exe	81

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{668C01E6-01E6-68C5-E668-1E68C1E668C5}\InProcServer32\ThreadingModel = "Apartment"	76dc91d44204d5e3bd81ad18c529e04a224a3e0f36a6a55ad00cbbc76491b93e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{668C01E6-01E6-68C5-E668-1E68C1E668C5}	76dc91d44204d5e3bd81ad18c529e04a224a3e0f36a6a55ad00cbbc76491b93e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{668C01E6-01E6-68C5-E668-1E68C1E668C5}\	76dc91d44204d5e3bd81ad18c529e04a224a3e0f36a6a55ad00cbbc76491b93e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{668C01E6-01E6-68C5-E668-1E68C1E668C5}\InProcServer32	76dc91d44204d5e3bd81ad18c529e04a224a3e0f36a6a55ad00cbbc76491b93e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{668C01E6-01E6-68C5-E668-1E68C1E668C5}\InProcServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\MSINFO\\01E668C5.dll"	76dc91d44204d5e3bd81ad18c529e04a224a3e0f36a6a55ad00cbbc76491b93e.exe

C:\Users\Admin\AppData\Local\Temp\76dc91d44204d5e3bd81ad18c529e04a224a3e0f36a6a55ad00cbbc76491b93e.exe
"C:\Users\Admin\AppData\Local\Temp\76dc91d44204d5e3bd81ad18c529e04a224a3e0f36a6a55ad00cbbc76491b93e.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:1932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 376
  2⤵
  - Program crash
  PID:4036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1932 -ip 1932
1⤵
PID:4648

C:\Program Files\Common Files\microsoft shared\MSInfo\01E668C5.dll

Filesize
58KB

MD5
95b6c22e3731d53d9e2071906435c7f7

SHA1
2c6c34c1fa2fd8830a7cb88720e0074899600440

SHA256
a98a007334fba35f440b46fa6268076a4509e6b4f073e00ceeb9c012c42b6511

SHA512
684ed34ac7818492b7a48ddfed5302ec4e56e3f6df2b11ab17bc7afe6437124cbec1c1b32afc124ff973f041b503990b1eeb3c8a1edb7f7814ddb63a02f15e7b

Download Submit
C:\Program Files\Common Files\microsoft shared\MSInfo\01E668C5.dll

Filesize
58KB

MD5
95b6c22e3731d53d9e2071906435c7f7

SHA1
2c6c34c1fa2fd8830a7cb88720e0074899600440

SHA256
a98a007334fba35f440b46fa6268076a4509e6b4f073e00ceeb9c012c42b6511

SHA512
684ed34ac7818492b7a48ddfed5302ec4e56e3f6df2b11ab17bc7afe6437124cbec1c1b32afc124ff973f041b503990b1eeb3c8a1edb7f7814ddb63a02f15e7b

Download Submit
memory/1932-137-0x0000000000490000-0x00000000004A3000-memory.dmp

Filesize
76KB

Download