c49ca202adaf0c34368609ba3a8406428272a862d3f2567696a97b1e239ad56f

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 00:53

Target

c49ca202adaf0c34368609ba3a8406428272a862d3f2567696a97b1e239ad56f.exe
Size

514KB
MD5

c366a160cbcacaa0966c6aaefbee5642
SHA1

6bf1c0ea1507b4e76926f2b84fdf9905090c0051
SHA256

c49ca202adaf0c34368609ba3a8406428272a862d3f2567696a97b1e239ad56f
SHA512

f224384e1dbba10f0b913928d1cd94c7a9875240dd5a389e16872927cd67963e9aaa3acc23cb9b0ebf837b5fb5f1396f7e34434e3174389aafad2ebb3adf0e40
SSDEEP

12288:pQYwLFTVvTSNIrF3Z4mxx36YaorxdLldYmss:pRwhA6QmXjZFdpdl

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1684	c49ca202adaf0c34368609ba3a8406428272a862d3f2567696a97b1e239ad56f.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\my_sfc_os.dll	c49ca202adaf0c34368609ba3a8406428272a862d3f2567696a97b1e239ad56f.exe
File created	C:\Windows\hpig_WS2.dat	c49ca202adaf0c34368609ba3a8406428272a862d3f2567696a97b1e239ad56f.exe
File created	C:\Windows\my_sfc_os.dll	c49ca202adaf0c34368609ba3a8406428272a862d3f2567696a97b1e239ad56f.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4844	1684	WerFault.exe	78

C:\Users\Admin\AppData\Local\Temp\c49ca202adaf0c34368609ba3a8406428272a862d3f2567696a97b1e239ad56f.exe
"C:\Users\Admin\AppData\Local\Temp\c49ca202adaf0c34368609ba3a8406428272a862d3f2567696a97b1e239ad56f.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 528
  2⤵
  - Program crash
  PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1684 -ip 1684
1⤵
PID:4180

C:\Windows\my_sfc_os.dll

Filesize
48KB

MD5
98c499fccb739ab23b75c0d8b98e0481

SHA1
0ef5c464823550d5f53dd485e91dabc5d5a1ba0a

SHA256
d9d8ce1b86b3978889466ab1b9f46778942d276922bf7533327a493083913087

SHA512
9e64ac13e18ab0a518bb85b6612520645b5ab2c9a5359ced943813ba7344714999f25ba0e52240ad2d0c2fefc76552ff43173adc46334ff0b5dba171fb58e4e6

Download Submit
memory/1684-132-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1684-133-0x0000000002280000-0x00000000022D4000-memory.dmp

Filesize
336KB

Download
memory/1684-134-0x0000000003410000-0x0000000003414000-memory.dmp

Filesize
16KB

Download
memory/1684-136-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1684-137-0x0000000002280000-0x00000000022D4000-memory.dmp

Filesize
336KB

Download