438dbdfb8faab97b3a3944acd6acb28b15dcdfda586be76384add6d16e4c15ce

Analysis

max time kernel
17s
max time network
21s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2023 21:54

Target

952c8dab97271b293b70690de99593ad.exe
Size

604KB
MD5

952c8dab97271b293b70690de99593ad
SHA1

89b841ba7b085bc2f5741ac0fe5507b87372ee62
SHA256

438dbdfb8faab97b3a3944acd6acb28b15dcdfda586be76384add6d16e4c15ce
SHA512

0b6bb12d6f83e02fd8420caa871251ad253e4973d62a572ca989d4c5d5b2d8774c2740ae2679cefa07c3aa7e36bcda4da4e7e69f3e219c234d8b88ff35d50a26
SSDEEP

6144:/d6WKPNDTb+HdtH9Wd1yxBMfoeHCDe2clFDwK3brqpnobns+NOYu56DCnEjyh0XL:/4Nj+Hdsy7MfDHUclJ3nHng6DCEjq0XL

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2428	embedded.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2064	1980	WerFault.exe	89

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 2892	3656	952c8dab97271b293b70690de99593ad.exe	87
PID 3656 wrote to memory of 2892	3656	952c8dab97271b293b70690de99593ad.exe	87
PID 3656 wrote to memory of 2892	3656	952c8dab97271b293b70690de99593ad.exe	87
PID 2892 wrote to memory of 2428	2892	cmd.exe	88
PID 2892 wrote to memory of 2428	2892	cmd.exe	88
PID 2892 wrote to memory of 2428	2892	cmd.exe	88
PID 2428 wrote to memory of 1980	2428	embedded.exe	89
PID 2428 wrote to memory of 1980	2428	embedded.exe	89
PID 2428 wrote to memory of 1980	2428	embedded.exe	89
PID 2428 wrote to memory of 1980	2428	embedded.exe	89

C:\Users\Admin\AppData\Local\Temp\952c8dab97271b293b70690de99593ad.exe
"C:\Users\Admin\AppData\Local\Temp\952c8dab97271b293b70690de99593ad.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c embedded.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Users\Admin\AppData\Local\Temp\embedded.exe
    embedded.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      4⤵
      PID:1980
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 408
        5⤵
        Program crash
        
        PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1980 -ip 1980
1⤵
PID:4248

C:\Users\Admin\AppData\Local\Temp\embedded.exe

Filesize
66KB

MD5
140d24af0c2b3a18529df12dfbc5f6de

SHA1
e8db5ad2b7ffede3e41b9c3adb24f3232d764931

SHA256
4eabb1adc035f035e010c0d0d259c683e18193f509946652ed8aa7c5d92b6a92

SHA512
a2ead649f155555ec3e55800494f833d18cea68afe736807ec23b5991242928a0853e451b60894ec8e0abe8c42db341c2237007981f38f0366fd7c6ecafb7415

Download Submit
C:\Users\Admin\AppData\Local\Temp\embedded.exe

Filesize
66KB

MD5
140d24af0c2b3a18529df12dfbc5f6de

SHA1
e8db5ad2b7ffede3e41b9c3adb24f3232d764931

SHA256
4eabb1adc035f035e010c0d0d259c683e18193f509946652ed8aa7c5d92b6a92

SHA512
a2ead649f155555ec3e55800494f833d18cea68afe736807ec23b5991242928a0853e451b60894ec8e0abe8c42db341c2237007981f38f0366fd7c6ecafb7415

Download Submit
memory/2428-137-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3656-138-0x0000000000910000-0x000000000098C000-memory.dmp

Filesize
496KB

Download