a26a23963dd3a85b9036aae1b44c3ef27f4de2d38fa1030045491f64e3fdf9d4

Analysis

max time kernel
156s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 00:40

Target

a26a23963dd3a85b9036aae1b44c3ef27f4de2d38fa1030045491f64e3fdf9d4.exe
Size

1009KB
MD5

cfb61e3b92012dd51d7a75226d6d7f77
SHA1

50c455d0614e7a0d666c67518ffdd58f942e626d
SHA256

a26a23963dd3a85b9036aae1b44c3ef27f4de2d38fa1030045491f64e3fdf9d4
SHA512

163da2d4bbe5957b8f28575c2e87916ee2bf3eb01e869afedde268638d9efacd003561b73f217c8beddfb39369a27739d044c40838d08c7c9ac3b03b7e1c58bf
SSDEEP

24576:Ylph7djjs6yF3KPb46DiGPVKqLXTeHOratURW/spierZlHu:YrpBaF6bttHLqOaAi6

Score

8^/10

Blocklisted process makes network request 8 IoCs

Loads dropped DLL 1 IoCs

pid	Process
1648	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1248	2200	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1648	2200	a26a23963dd3a85b9036aae1b44c3ef27f4de2d38fa1030045491f64e3fdf9d4.exe	82
PID 2200 wrote to memory of 1648	2200	a26a23963dd3a85b9036aae1b44c3ef27f4de2d38fa1030045491f64e3fdf9d4.exe	82
PID 2200 wrote to memory of 1648	2200	a26a23963dd3a85b9036aae1b44c3ef27f4de2d38fa1030045491f64e3fdf9d4.exe	82

C:\Users\Admin\AppData\Local\Temp\a26a23963dd3a85b9036aae1b44c3ef27f4de2d38fa1030045491f64e3fdf9d4.exe
"C:\Users\Admin\AppData\Local\Temp\a26a23963dd3a85b9036aae1b44c3ef27f4de2d38fa1030045491f64e3fdf9d4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Wuwedteata.tmp",Tiuqiiueaur
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:1648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 472
  2⤵
  - Program crash
  PID:1248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2200 -ip 2200
1⤵
PID:4396

C:\Users\Admin\AppData\Local\Temp\Wuwedteata.tmp

Filesize
752KB

MD5
ad4fe6dd11eca5f7254e0e00ed47d984

SHA1
e809de0322d74dd4642f215f46f22b3a9b7caa21

SHA256
6ecc725eab418e27d8fa2f1031fce6bc119d677b8d72e0447050a87489e8e0ca

SHA512
d09f4f9a94f34fe1a6f5fe78ec32e91026fe07263183d4d41c4a51cfa7ee5fbc1b38d2ebeda20a717a2a730af011d73d113decb3ae2fe9db50530c095cf33ea3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wuwedteata.tmp

Filesize
752KB

MD5
ad4fe6dd11eca5f7254e0e00ed47d984

SHA1
e809de0322d74dd4642f215f46f22b3a9b7caa21

SHA256
6ecc725eab418e27d8fa2f1031fce6bc119d677b8d72e0447050a87489e8e0ca

SHA512
d09f4f9a94f34fe1a6f5fe78ec32e91026fe07263183d4d41c4a51cfa7ee5fbc1b38d2ebeda20a717a2a730af011d73d113decb3ae2fe9db50530c095cf33ea3

Download Submit
memory/2200-132-0x0000000004625000-0x0000000004703000-memory.dmp

Filesize
888KB

Download
memory/2200-133-0x0000000004790000-0x00000000048B1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-134-0x0000000000400000-0x00000000028B6000-memory.dmp

Filesize
36.7MB

Download
memory/2200-138-0x0000000000400000-0x00000000028B6000-memory.dmp

Filesize
36.7MB

Download