dcb24b04d4e36b27269c5cd8971167b94587712efc62b04e82f62b0719a64304

Analysis

max time kernel
6s
max time network
8s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2023, 21:57

Target

f0ef3105a17c7f34aec310f64cbdb865.exe
Size

604KB
MD5

f0ef3105a17c7f34aec310f64cbdb865
SHA1

db3638eeb2ba28983d45cad37091dc24703a63be
SHA256

dcb24b04d4e36b27269c5cd8971167b94587712efc62b04e82f62b0719a64304
SHA512

aed1a398fd07c00489221fefa557bec0734e8b1531f92f555767bbbc6b6f477717f03855c57729869405464eab43a4279de24e87a45b469ae7994df7ece81213
SSDEEP

6144:ZdfbCP2DTb+HdtH9Wd1yxBMf0eVCDs2c9kDwK3bLqpnobns+NOYup6yCwMjyh0XL:Z+2j+Hdsy7MfXVqc9w33Hnw6yCVjq0XL

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
552	embedded.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4164	3804	WerFault.exe	83

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1120	f0ef3105a17c7f34aec310f64cbdb865.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 3924	1120	f0ef3105a17c7f34aec310f64cbdb865.exe	81
PID 1120 wrote to memory of 3924	1120	f0ef3105a17c7f34aec310f64cbdb865.exe	81
PID 1120 wrote to memory of 3924	1120	f0ef3105a17c7f34aec310f64cbdb865.exe	81
PID 3924 wrote to memory of 552	3924	cmd.exe	82
PID 3924 wrote to memory of 552	3924	cmd.exe	82
PID 3924 wrote to memory of 552	3924	cmd.exe	82
PID 552 wrote to memory of 3804	552	embedded.exe	83
PID 552 wrote to memory of 3804	552	embedded.exe	83
PID 552 wrote to memory of 3804	552	embedded.exe	83
PID 552 wrote to memory of 3804	552	embedded.exe	83

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3804 -ip 3804
1⤵
PID:4596

C:\Users\Admin\AppData\Local\Temp\embedded.exe

Filesize
66KB

MD5
140d24af0c2b3a18529df12dfbc5f6de

SHA1
e8db5ad2b7ffede3e41b9c3adb24f3232d764931

SHA256
4eabb1adc035f035e010c0d0d259c683e18193f509946652ed8aa7c5d92b6a92

SHA512
a2ead649f155555ec3e55800494f833d18cea68afe736807ec23b5991242928a0853e451b60894ec8e0abe8c42db341c2237007981f38f0366fd7c6ecafb7415

Download Submit
C:\Users\Admin\AppData\Local\Temp\embedded.exe

Filesize
66KB

MD5
140d24af0c2b3a18529df12dfbc5f6de

SHA1
e8db5ad2b7ffede3e41b9c3adb24f3232d764931

SHA256
4eabb1adc035f035e010c0d0d259c683e18193f509946652ed8aa7c5d92b6a92

SHA512
a2ead649f155555ec3e55800494f833d18cea68afe736807ec23b5991242928a0853e451b60894ec8e0abe8c42db341c2237007981f38f0366fd7c6ecafb7415

Download Submit
memory/552-137-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download