71f53c0c9dd38ec14f39d541efecfdb8fc6237db0dc5809c16fc98bb5e86f73c

Analysis

max time kernel
146s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 20:40

Target

3bf41f89fc2fedfe7a06e14962847b10.exe
Size

3.0MB
MD5

3bf41f89fc2fedfe7a06e14962847b10
SHA1

bae95bbbccb391e845c881255d5cc68a2ed66944
SHA256

71f53c0c9dd38ec14f39d541efecfdb8fc6237db0dc5809c16fc98bb5e86f73c
SHA512

f6a4ae6ae2a7598fa0e7c7dc062692a45a103e599b650dc7257ce1039b20a52856091b9f31b13001314eecefc8bf1efae4e192c4ba5d176a7eecea8b299ae80c
SSDEEP

49152:eSczvMkk/HqVoOw+gStLIkV6oxATeTpJGviYtBwkK/xyvBnIYsMf5HTeu7g5Ar9R:rSeGLgqLIYAqt4GhYsMNyb5Ar9LFaUZ

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4432	41EB.tmp

Program crash 1 IoCs

pid	pid_target	Process
1292	4432	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 4432	4004	3bf41f89fc2fedfe7a06e14962847b10.exe	22
PID 4004 wrote to memory of 4432	4004	3bf41f89fc2fedfe7a06e14962847b10.exe	22
PID 4004 wrote to memory of 4432	4004	3bf41f89fc2fedfe7a06e14962847b10.exe	22

C:\Users\Admin\AppData\Local\Temp\3bf41f89fc2fedfe7a06e14962847b10.exe
"C:\Users\Admin\AppData\Local\Temp\3bf41f89fc2fedfe7a06e14962847b10.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Users\Admin\AppData\Local\Temp\41EB.tmp
  C:\Users\Admin\AppData\Local\Temp\41EB.tmp
  2⤵
  - Executes dropped EXE
  PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4432 -ip 4432
1⤵
PID:2008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 232
1⤵
- Program crash
PID:1292

C:\Users\Admin\AppData\Local\Temp\41EB.tmp

Filesize
74KB

MD5
017968a1fc43b8006a01f169454800c2

SHA1
7134ee1cc0f94eefe5ebece2082da7b4aadce516

SHA256
fbcac5d2f4cc2e1bca397d7e267f9ce6f656bb1b72f4ebc8343fbd41fc593504

SHA512
b498f11c0372280b2ab740d624f0f390ce7b08652eb224dd044f218a6433786f6856a9a36b8549bc1eada2a7cb81117fa94678a0be4949589897d5fcc153363e

Download Submit
memory/4004-0-0x0000000000400000-0x000000000041B678-memory.dmp

Filesize
109KB

Download
memory/4004-14-0x0000000000400000-0x000000000041B678-memory.dmp

Filesize
109KB

Download
memory/4004-16-0x0000000000400000-0x000000000041B678-memory.dmp

Filesize
109KB

Download
memory/4432-13-0x00000000009D0000-0x00000000009E0000-memory.dmp

Filesize
64KB

Download
memory/4432-12-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download