eb02b3e17a6742879c54015b49ad7fabf85e2b187c73311a413b4127065b0c98

Analysis

max time kernel
60s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 17:05

Target

eb02b3e17a6742879c54015b49ad7fabf85e2b187c73311a413b4127065b0c98.exe
Size

264KB
MD5

076ecb57c8ff1513c2d20c2e9e7ea88c
SHA1

ac64c9475bbdfb023d006b52325b70127b4bc32b
SHA256

eb02b3e17a6742879c54015b49ad7fabf85e2b187c73311a413b4127065b0c98
SHA512

f9e8629720c31311ee5992628d303b4a4fd100d032bd2e7057e1000de55d04d012d42f1a889791e0b521fb50bade466ee002bdf00ead74cbd74e93c0172a81c8
SSDEEP

3072:Xc/q0ql6gopMQgRnJ5mw/G0jgVxBDCH7OgtBLfkajaAXjBjsPVHDJA6u8kAmA:Xci0FlgRnrmIjm347FLfPFsVHDqjQ

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
4396	eb02b3e17a6742879c54015b49ad7fabf85e2b187c73311a413b4127065b0c98mgr.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2204	4396	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 4396	3704	eb02b3e17a6742879c54015b49ad7fabf85e2b187c73311a413b4127065b0c98.exe	83
PID 3704 wrote to memory of 4396	3704	eb02b3e17a6742879c54015b49ad7fabf85e2b187c73311a413b4127065b0c98.exe	83
PID 3704 wrote to memory of 4396	3704	eb02b3e17a6742879c54015b49ad7fabf85e2b187c73311a413b4127065b0c98.exe	83

C:\Users\Admin\AppData\Local\Temp\eb02b3e17a6742879c54015b49ad7fabf85e2b187c73311a413b4127065b0c98.exe
"C:\Users\Admin\AppData\Local\Temp\eb02b3e17a6742879c54015b49ad7fabf85e2b187c73311a413b4127065b0c98.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Users\Admin\AppData\Local\Temp\eb02b3e17a6742879c54015b49ad7fabf85e2b187c73311a413b4127065b0c98mgr.exe
  C:\Users\Admin\AppData\Local\Temp\eb02b3e17a6742879c54015b49ad7fabf85e2b187c73311a413b4127065b0c98mgr.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 384
    3⤵
    - Program crash
    PID:2204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4396 -ip 4396
1⤵
PID:3780

C:\Users\Admin\AppData\Local\Temp\eb02b3e17a6742879c54015b49ad7fabf85e2b187c73311a413b4127065b0c98mgr.exe

Filesize
192KB

MD5
72864b90643b2ff7a3e4c06b03ad2ce7

SHA1
52f60736728362514dec7880f67009408bf744da

SHA256
c0dc483d5d52f102a46125ba7b79757cf535aaf6075ff1bf0b255243d0b88c43

SHA512
b6f2abb30dedc588601324a203f348f453443a28de2a82b16ae175621471126680bf239e502e5c4f848955a6031e211976a3aa24eaa9e1e56b06c30916a23bf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\eb02b3e17a6742879c54015b49ad7fabf85e2b187c73311a413b4127065b0c98mgr.exe

Filesize
192KB

MD5
72864b90643b2ff7a3e4c06b03ad2ce7

SHA1
52f60736728362514dec7880f67009408bf744da

SHA256
c0dc483d5d52f102a46125ba7b79757cf535aaf6075ff1bf0b255243d0b88c43

SHA512
b6f2abb30dedc588601324a203f348f453443a28de2a82b16ae175621471126680bf239e502e5c4f848955a6031e211976a3aa24eaa9e1e56b06c30916a23bf2

Download Submit
memory/3704-135-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3704-136-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download