14e45f66bb1010cd2bac463af2d39e7d49b3e08437f5e3db4a70c26d70c44c2b

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 06:53

Target

0cf39bdbd7a96e4e38d55a9853169964.exe
Size

677KB
MD5

0cf39bdbd7a96e4e38d55a9853169964
SHA1

15341f7a4d7dc5ffee9ab4be09e585fdf45299a6
SHA256

14e45f66bb1010cd2bac463af2d39e7d49b3e08437f5e3db4a70c26d70c44c2b
SHA512

f840430c7c0342dab15677f6924e1561257fd6091767bf0f7634f6b232ade09907d5c56a3ea943360abb423c5fdcb13089fda6db60d4a77e7261066201453c41
SSDEEP

12288:oigpqBNTX/C84ZrRj045nurrv6Q6BrYYMbhteQDZhOg5B/KEHiZofAAUmAY:oigwBNTvt4jjT5ng2QWYnbhteQDZhOgD

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3416	0cf39bdbd7a96e4e38d55a9853169964.tmp

Program crash 2 IoCs

pid	pid_target	Process	procid_target
864	3416	WerFault.exe	91
4056	2152	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 3416	2152	0cf39bdbd7a96e4e38d55a9853169964.exe	91
PID 2152 wrote to memory of 3416	2152	0cf39bdbd7a96e4e38d55a9853169964.exe	91
PID 2152 wrote to memory of 3416	2152	0cf39bdbd7a96e4e38d55a9853169964.exe	91

C:\Users\Admin\AppData\Local\Temp\0cf39bdbd7a96e4e38d55a9853169964.exe
"C:\Users\Admin\AppData\Local\Temp\0cf39bdbd7a96e4e38d55a9853169964.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\AppData\Local\Temp\is-MJHM3.tmp\0cf39bdbd7a96e4e38d55a9853169964.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-MJHM3.tmp\0cf39bdbd7a96e4e38d55a9853169964.tmp" /SL5="$4020C,645914,54272,C:\Users\Admin\AppData\Local\Temp\0cf39bdbd7a96e4e38d55a9853169964.exe"
  2⤵
  - Executes dropped EXE
  PID:3416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 216
    3⤵
    - Program crash
    PID:864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 480
  2⤵
  - Program crash
  PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3416 -ip 3416
1⤵
PID:4860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2152 -ip 2152
1⤵
PID:380

C:\Users\Admin\AppData\Local\Temp\is-MJHM3.tmp\0cf39bdbd7a96e4e38d55a9853169964.tmp

Filesize
63KB

MD5
5a13972d7049fbf18e4f680de908ba72

SHA1
bc59186849ea6e9701c055779bb3fc823384d517

SHA256
222f9e180c6fe79bc5e8452f6f76fc690132a14386a95bd9df4fde16d19b5a3f

SHA512
4d154a9a9d687b482e6f1ae06ed933b7887149ca2062a90857c49d085c1274238a4b304ae5411354281d4eaf172591b65577d45273bbc9f8af1a48162085607d

Download Submit
memory/2152-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2152-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2152-7-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2152-12-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3416-8-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download