bb8905b7964ae90f61342b7cef9740f68a24ed426fba3586ca499fe201ab9bd7

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2023, 03:30

Target

78f000c1901081a2b7f43e55843ba89b3ed2be2cab2c3c36f04c768800863940.exe
Size

12KB
MD5

44ad16455efc3051fd00fe73e3bb7e40
SHA1

198bd41511981e7307cc2513ce7030aa5b8e0c0d
SHA256

78f000c1901081a2b7f43e55843ba89b3ed2be2cab2c3c36f04c768800863940
SHA512

09125cf385d4c0cbdf540d05114b1e7b018c950ff44b6cebe8d4e3ed3103bf08b41045a45597d84b63a2c3746ea21a8a15724017b61c02b0f9b116a9f277238d
SSDEEP

192:5rfqZdzEvo1K2hhT4l1f3wyziSv3CIZcsDGl1Hh6FehNuyyCcxjJaAEJBjt:lyd4g1Kbl+2SIZcsDo1squy6xj4bb

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3980	services.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4140	3980	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 4168	3980	services.exe	86
PID 3980 wrote to memory of 4168	3980	services.exe	86
PID 3980 wrote to memory of 4168	3980	services.exe	86

C:\Users\Admin\AppData\Local\Temp\78f000c1901081a2b7f43e55843ba89b3ed2be2cab2c3c36f04c768800863940.exe
"C:\Users\Admin\AppData\Local\Temp\78f000c1901081a2b7f43e55843ba89b3ed2be2cab2c3c36f04c768800863940.exe"
1⤵
PID:3248

C:\Users\Admin\AppData\Local\services.exe
C:\Users\Admin\AppData\Local\services.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:4168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 584
  2⤵
  - Program crash
  PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3980 -ip 3980
1⤵
PID:4500

C:\Users\Admin\AppData\Local\services.exe

Filesize
12KB

MD5
44ad16455efc3051fd00fe73e3bb7e40

SHA1
198bd41511981e7307cc2513ce7030aa5b8e0c0d

SHA256
78f000c1901081a2b7f43e55843ba89b3ed2be2cab2c3c36f04c768800863940

SHA512
09125cf385d4c0cbdf540d05114b1e7b018c950ff44b6cebe8d4e3ed3103bf08b41045a45597d84b63a2c3746ea21a8a15724017b61c02b0f9b116a9f277238d

Download Submit
C:\Users\Admin\AppData\Local\services.exe

Filesize
12KB

MD5
44ad16455efc3051fd00fe73e3bb7e40

SHA1
198bd41511981e7307cc2513ce7030aa5b8e0c0d

SHA256
78f000c1901081a2b7f43e55843ba89b3ed2be2cab2c3c36f04c768800863940

SHA512
09125cf385d4c0cbdf540d05114b1e7b018c950ff44b6cebe8d4e3ed3103bf08b41045a45597d84b63a2c3746ea21a8a15724017b61c02b0f9b116a9f277238d

Download Submit