46a37b8c450f2546e328cf5bfd8c3e0a5cb1db6292e8ae2fbeb16f6b681b29a2

Analysis

max time kernel
127s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/07/2023, 17:26

Target

caacda7f886381_JC.exe
Size

239KB
MD5

caacda7f8863812c07b6b625c895fe03
SHA1

ee1751cafebfa8a686402ea971f698322e157f43
SHA256

46a37b8c450f2546e328cf5bfd8c3e0a5cb1db6292e8ae2fbeb16f6b681b29a2
SHA512

c885cf01338606fc3097a5d4f8892e83423d96a0bf74657965f239ff1b47511ee5b2cdfaf925525d160932ab6c8820c5e8575f6643e4760a86d7ec529f286783
SSDEEP

3072:lxUm75Fku3eKeO213SJReOqdmErj+HyHnNVIPL/+ybbiW1u46Q7qV3lU8xM:fU8Dk11CJ1qDWUNVIT/bblS9x

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3764	Brockschmidt.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Wesley\Brockschmidt.exe	caacda7f886381_JC.exe
File opened for modification	C:\Program Files\Wesley\Brockschmidt.exe	caacda7f886381_JC.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2028	2548	WerFault.exe	81
1224	2548	WerFault.exe	81

Suspicious use of SetWindowsHookEx 8 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 3764	2548	caacda7f886381_JC.exe	84
PID 2548 wrote to memory of 3764	2548	caacda7f886381_JC.exe	84
PID 2548 wrote to memory of 3764	2548	caacda7f886381_JC.exe	84

C:\Users\Admin\AppData\Local\Temp\caacda7f886381_JC.exe
"C:\Users\Admin\AppData\Local\Temp\caacda7f886381_JC.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Program Files\Wesley\Brockschmidt.exe
  "C:\Program Files\Wesley\Brockschmidt.exe" "33201"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 1020
  2⤵
  - Program crash
  PID:2028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 1092
  2⤵
  - Program crash
  PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2548 -ip 2548
1⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2548 -ip 2548
1⤵
PID:4248

C:\Program Files\Wesley\Brockschmidt.exe

Filesize
239KB

MD5
ab8b361e7910e963d9e9add128f736a5

SHA1
c589c6921eaded68d7dd32a863a92c357c6b5c0c

SHA256
779656e47f6259423ea71930b17da3ceb890bf10008a2bcc5ade6f7532545cef

SHA512
0ee19cd69da42bf84cc80be626e9a1fae0fc1f9e1a49f37af3e444546aacf02a4b9980d8fa705339685e21153a61459a126ae8221eb794c1f85046a97a89d79d

Download Submit
C:\Program Files\Wesley\Brockschmidt.exe

Filesize
239KB

MD5
ab8b361e7910e963d9e9add128f736a5

SHA1
c589c6921eaded68d7dd32a863a92c357c6b5c0c

SHA256
779656e47f6259423ea71930b17da3ceb890bf10008a2bcc5ade6f7532545cef

SHA512
0ee19cd69da42bf84cc80be626e9a1fae0fc1f9e1a49f37af3e444546aacf02a4b9980d8fa705339685e21153a61459a126ae8221eb794c1f85046a97a89d79d

Download Submit