a8fd726460c660ee10b0dfddbac586bff3f684ab51682243392f7e182f98f09c

Analysis

max time kernel
11s
max time network
12s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2023 13:47

Target

8bee14e61a36f8e63989509f50f67ff8.exe
Size

604KB
MD5

8bee14e61a36f8e63989509f50f67ff8
SHA1

25b7e8c8889a1ba6faf805e6a88618ef4c5e6d0b
SHA256

a8fd726460c660ee10b0dfddbac586bff3f684ab51682243392f7e182f98f09c
SHA512

3d687da3e70d6d778ba7e4403c918bfd1339654847daa1eac8ff8ea060d6273624c5a57a9b7ef168152113c73c5b96c0aa0714f173251ebabbe80a3742abe0be
SSDEEP

6144:7dNbCP2DTb+HdtH9Wd1yxBMfLeQCDc2c9kDwK3bLqpnobns+NOYup6+CwMjyh0XL:702j+Hdsy7MfKQKc9w33Hnw6+CVjq0XL

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4376	embedded.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2428	4404	WerFault.exe	88

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 2592	4188	8bee14e61a36f8e63989509f50f67ff8.exe	86
PID 4188 wrote to memory of 2592	4188	8bee14e61a36f8e63989509f50f67ff8.exe	86
PID 4188 wrote to memory of 2592	4188	8bee14e61a36f8e63989509f50f67ff8.exe	86
PID 2592 wrote to memory of 4376	2592	cmd.exe	87
PID 2592 wrote to memory of 4376	2592	cmd.exe	87
PID 2592 wrote to memory of 4376	2592	cmd.exe	87
PID 4376 wrote to memory of 4404	4376	embedded.exe	88
PID 4376 wrote to memory of 4404	4376	embedded.exe	88
PID 4376 wrote to memory of 4404	4376	embedded.exe	88
PID 4376 wrote to memory of 4404	4376	embedded.exe	88

C:\Users\Admin\AppData\Local\Temp\8bee14e61a36f8e63989509f50f67ff8.exe
"C:\Users\Admin\AppData\Local\Temp\8bee14e61a36f8e63989509f50f67ff8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c embedded.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Users\Admin\AppData\Local\Temp\embedded.exe
    embedded.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      4⤵
      PID:4404
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 232
        5⤵
        Program crash
        
        PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4404 -ip 4404
1⤵
PID:1376

C:\Users\Admin\AppData\Local\Temp\embedded.exe

Filesize
66KB

MD5
140d24af0c2b3a18529df12dfbc5f6de

SHA1
e8db5ad2b7ffede3e41b9c3adb24f3232d764931

SHA256
4eabb1adc035f035e010c0d0d259c683e18193f509946652ed8aa7c5d92b6a92

SHA512
a2ead649f155555ec3e55800494f833d18cea68afe736807ec23b5991242928a0853e451b60894ec8e0abe8c42db341c2237007981f38f0366fd7c6ecafb7415

Download Submit
C:\Users\Admin\AppData\Local\Temp\embedded.exe

Filesize
66KB

MD5
140d24af0c2b3a18529df12dfbc5f6de

SHA1
e8db5ad2b7ffede3e41b9c3adb24f3232d764931

SHA256
4eabb1adc035f035e010c0d0d259c683e18193f509946652ed8aa7c5d92b6a92

SHA512
a2ead649f155555ec3e55800494f833d18cea68afe736807ec23b5991242928a0853e451b60894ec8e0abe8c42db341c2237007981f38f0366fd7c6ecafb7415

Download Submit
memory/4188-138-0x0000000000270000-0x00000000002EC000-memory.dmp

Filesize
496KB

Download
memory/4376-137-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download