d3eef85b7fc5291b76a569864b5e35b471d838b897a9c4f73915698b1826d4bd

Analysis

max time kernel
133s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2023, 18:53

Target

cf04ba4779867c0726c69e230e145fd8.exe
Size

1.1MB
MD5

cf04ba4779867c0726c69e230e145fd8
SHA1

ce8a5522d32cee3d9da5584d432f61b1e122cbc8
SHA256

d3eef85b7fc5291b76a569864b5e35b471d838b897a9c4f73915698b1826d4bd
SHA512

7b800b136a4356bcfe51d6709b623c8467b16fc0d5b4df07eeac8e045cedf39b2df55318c08d25b2e276559e8abce293f97c1862e4505cc6b4c8e1d24713f877
SSDEEP

24576:Wm9ficCrmX9mZgOLxfW6CAEerBf1K3Ey4IFy6kwHideoZCjBE:WmBPnX9pWyAEQBf1XRIFy6kwH+RC9E

Score

8^/10

Blocklisted process makes network request 3 IoCs

Loads dropped DLL 1 IoCs

pid	Process
1356	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2264	4600	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 1356	4600	cf04ba4779867c0726c69e230e145fd8.exe	79
PID 4600 wrote to memory of 1356	4600	cf04ba4779867c0726c69e230e145fd8.exe	79
PID 4600 wrote to memory of 1356	4600	cf04ba4779867c0726c69e230e145fd8.exe	79

C:\Users\Admin\AppData\Local\Temp\cf04ba4779867c0726c69e230e145fd8.exe
"C:\Users\Admin\AppData\Local\Temp\cf04ba4779867c0726c69e230e145fd8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Ryfererfh.tmp",Fwpthq
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:1356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 552
  2⤵
  - Program crash
  PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4600 -ip 4600
1⤵
PID:4860

C:\Users\Admin\AppData\Local\Temp\Ryfererfh.tmp

Filesize
817KB

MD5
0a6c58fc386c9a4d7d43b809447f3eac

SHA1
b07d0ae1180e21bf79b3b720d9e03e2b7982972d

SHA256
d71c0aaec63294fb11af30ff408e94b5fff656149da01e3f7a97e3026580d5c2

SHA512
e2d08ae110f30257daa9341d1e3c91d6c50f6b32107d1e1ca0badcce872d09ac3d3a3998f26b1f93c3b1937317ce5ea240652d1b784c5a4d2e30273c19a9b6ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ryfererfh.tmp

Filesize
817KB

MD5
0a6c58fc386c9a4d7d43b809447f3eac

SHA1
b07d0ae1180e21bf79b3b720d9e03e2b7982972d

SHA256
d71c0aaec63294fb11af30ff408e94b5fff656149da01e3f7a97e3026580d5c2

SHA512
e2d08ae110f30257daa9341d1e3c91d6c50f6b32107d1e1ca0badcce872d09ac3d3a3998f26b1f93c3b1937317ce5ea240652d1b784c5a4d2e30273c19a9b6ad

Download Submit
memory/4600-135-0x00000000049D6000-0x0000000004ABF000-memory.dmp

Filesize
932KB

Download
memory/4600-136-0x0000000004B40000-0x0000000004C6C000-memory.dmp

Filesize
1.2MB

Download
memory/4600-137-0x0000000000400000-0x0000000002C86000-memory.dmp

Filesize
40.5MB

Download
memory/4600-138-0x0000000000400000-0x0000000002C86000-memory.dmp

Filesize
40.5MB

Download