9233bd72f4c869842e7c124a63d2a7b857c2d93b09af759536bd598eb309c2ca

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2023, 17:51

Target

1ab3e99c689db8dedd0ceac7f63ba5c0_exe32_JC.exe
Size

359KB
MD5

1ab3e99c689db8dedd0ceac7f63ba5c0
SHA1

7eda1fb778070c4c6e13ca1d5d2f608b7a468234
SHA256

9233bd72f4c869842e7c124a63d2a7b857c2d93b09af759536bd598eb309c2ca
SHA512

17e4e1f9bee2339dbe1ccc3284c4a21c02677750b0fd9e53c385654d125f76633fe4b7f2d946cb2f9ae155077a8bce1a8ba4365d7c6197647b9ab079c8d211c3
SSDEEP

6144:UF67gxpNxM1EtxqRML6Xr4q/MgVz4Y5gDKK0LHYtVzbOJo:UFg+cmxpkr4QvVzd5gz0Lexj

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3772	1ab3e99c689db8dedd0ceac7f63ba5c0_exe32_JC.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2968	2556	WerFault.exe	82
4316	3772	WerFault.exe	86
1576	3772	WerFault.exe	86
4140	3772	WerFault.exe	86
992	3772	WerFault.exe	86

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2556	1ab3e99c689db8dedd0ceac7f63ba5c0_exe32_JC.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3772	1ab3e99c689db8dedd0ceac7f63ba5c0_exe32_JC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 3772	2556	1ab3e99c689db8dedd0ceac7f63ba5c0_exe32_JC.exe	86
PID 2556 wrote to memory of 3772	2556	1ab3e99c689db8dedd0ceac7f63ba5c0_exe32_JC.exe	86
PID 2556 wrote to memory of 3772	2556	1ab3e99c689db8dedd0ceac7f63ba5c0_exe32_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\1ab3e99c689db8dedd0ceac7f63ba5c0_exe32_JC.exe
"C:\Users\Admin\AppData\Local\Temp\1ab3e99c689db8dedd0ceac7f63ba5c0_exe32_JC.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 384
  2⤵
  - Program crash
  PID:2968
- C:\Users\Admin\AppData\Local\Temp\1ab3e99c689db8dedd0ceac7f63ba5c0_exe32_JC.exe
  C:\Users\Admin\AppData\Local\Temp\1ab3e99c689db8dedd0ceac7f63ba5c0_exe32_JC.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 360
    3⤵
    - Program crash
    PID:4316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 772
    3⤵
    - Program crash
    PID:1576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 812
    3⤵
    - Program crash
    PID:4140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 820
    3⤵
    - Program crash
    PID:992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2556 -ip 2556
1⤵
PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3772 -ip 3772
1⤵
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3772 -ip 3772
1⤵
PID:4464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 3772 -ip 3772
1⤵
PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3772 -ip 3772
1⤵
PID:2104

C:\Users\Admin\AppData\Local\Temp\1ab3e99c689db8dedd0ceac7f63ba5c0_exe32_JC.exe

Filesize
359KB

MD5
5244d5c02f33dd99d64aeaf16585d4e5

SHA1
50b119fb24a41df0a6fa2cca3853d6a1236a1dfe

SHA256
46de93eaecb92aca04046cab5a0c497a8c714b771de3fa0c89d058ef3d7461d5

SHA512
905b45da7b0caf92d310be0d5938d322db64649146890d4449b9eb42b900c4a9cf795167f86337f21f5966a549c81f660e5149e441419846b45e6173e9605077

Download Submit
memory/2556-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2556-6-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3772-7-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3772-8-0x00000000014C0000-0x00000000014F5000-memory.dmp

Filesize
212KB

Download
memory/3772-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3772-14-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download