dbe71282313d66d037fe2178f4ae7939da46de15895cdb8ae3d1e8e0fbf6d053

Analysis

max time kernel
141s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2023, 01:36

Target

6cfa71864004eb0d5336f7ff2673152b.exe
Size

604KB
MD5

6cfa71864004eb0d5336f7ff2673152b
SHA1

7b9a3bb63c0f89abe5ab2ea59078a5fc3211f00a
SHA256

dbe71282313d66d037fe2178f4ae7939da46de15895cdb8ae3d1e8e0fbf6d053
SHA512

6e7343e81a5dc6d8b6433efcbd1349520f020eb64a637fe78ce54513a66720ffccda800cb3a179704b9fcdec5398f2466b79785eb53f65e88383dc8ecc70bc6e
SSDEEP

6144:9d1W+PZj6b+HdtH9Wd1yxBMf7eHCDMNxAoDwK3bHKsnobns+NOYuR67N12tjyh07:93Zu+Hdsy7MfaHxxA83LUnY67NKjq0XL

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4724	embedded.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1164	2152	WerFault.exe	86

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 1144	4680	6cfa71864004eb0d5336f7ff2673152b.exe	84
PID 4680 wrote to memory of 1144	4680	6cfa71864004eb0d5336f7ff2673152b.exe	84
PID 4680 wrote to memory of 1144	4680	6cfa71864004eb0d5336f7ff2673152b.exe	84
PID 1144 wrote to memory of 4724	1144	cmd.exe	85
PID 1144 wrote to memory of 4724	1144	cmd.exe	85
PID 1144 wrote to memory of 4724	1144	cmd.exe	85
PID 4724 wrote to memory of 2152	4724	embedded.exe	86
PID 4724 wrote to memory of 2152	4724	embedded.exe	86
PID 4724 wrote to memory of 2152	4724	embedded.exe	86
PID 4724 wrote to memory of 2152	4724	embedded.exe	86

C:\Users\Admin\AppData\Local\Temp\6cfa71864004eb0d5336f7ff2673152b.exe
"C:\Users\Admin\AppData\Local\Temp\6cfa71864004eb0d5336f7ff2673152b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c embedded.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Users\Admin\AppData\Local\Temp\embedded.exe
    embedded.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4724
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      4⤵
      PID:2152
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 88
        5⤵
        Program crash
        
        PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2152 -ip 2152
1⤵
PID:1676

C:\Users\Admin\AppData\Local\Temp\embedded.exe

Filesize
66KB

MD5
140d24af0c2b3a18529df12dfbc5f6de

SHA1
e8db5ad2b7ffede3e41b9c3adb24f3232d764931

SHA256
4eabb1adc035f035e010c0d0d259c683e18193f509946652ed8aa7c5d92b6a92

SHA512
a2ead649f155555ec3e55800494f833d18cea68afe736807ec23b5991242928a0853e451b60894ec8e0abe8c42db341c2237007981f38f0366fd7c6ecafb7415

Download Submit
C:\Users\Admin\AppData\Local\Temp\embedded.exe

Filesize
66KB

MD5
140d24af0c2b3a18529df12dfbc5f6de

SHA1
e8db5ad2b7ffede3e41b9c3adb24f3232d764931

SHA256
4eabb1adc035f035e010c0d0d259c683e18193f509946652ed8aa7c5d92b6a92

SHA512
a2ead649f155555ec3e55800494f833d18cea68afe736807ec23b5991242928a0853e451b60894ec8e0abe8c42db341c2237007981f38f0366fd7c6ecafb7415

Download Submit
memory/4680-138-0x0000000000180000-0x00000000001FC000-memory.dmp

Filesize
496KB

Download
memory/4724-137-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download