8ccde9f3a3009303d6c64005c9c34aa23496355c97a15bc1a3b97706b8ddb13c

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 23:55

Target

20c0e56ffac6877b03141f0fdb7a8050.exe
Size

22KB
MD5

20c0e56ffac6877b03141f0fdb7a8050
SHA1

6cfea95cfe792fd7e39ef5bd09a6f4308497bec8
SHA256

8ccde9f3a3009303d6c64005c9c34aa23496355c97a15bc1a3b97706b8ddb13c
SHA512

6abd600973469440b7232ad75a4a75446716a63740f2d79536948abe01bcd68460b384435cb03659f9171251a46de87f2d5443781607a9d4c2cf751da93f95ff
SSDEEP

384:09u3U5ZpvLw5ikMN2Iqt5l1Q8dEike1z0KCCdDZcXYXkxCNGMWVk:NWvsc1N2Iqnd/dDOXYUGW

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2036	20c0e56ffac6877b03141f0fdb7a8050.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\netsrvcs.dll	20c0e56ffac6877b03141f0fdb7a8050.exe
File opened for modification	C:\Windows\SysWOW64\netsrvcs.dll	20c0e56ffac6877b03141f0fdb7a8050.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3652	2036	WerFault.exe	14

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2036	20c0e56ffac6877b03141f0fdb7a8050.exe
2036	20c0e56ffac6877b03141f0fdb7a8050.exe

C:\Users\Admin\AppData\Local\Temp\20c0e56ffac6877b03141f0fdb7a8050.exe
"C:\Users\Admin\AppData\Local\Temp\20c0e56ffac6877b03141f0fdb7a8050.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 324
  2⤵
  - Program crash
  PID:3652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2036 -ip 2036
1⤵
PID:4596

C:\Users\Admin\AppData\Local\Temp\20c0e56ffac6877b03141f0fdb7a8050.dat

Filesize
19KB

MD5
492a0d2302f49bd3afceec4e7ba24442

SHA1
30435d0395a10a4001267e1df6ec5394b5918b34

SHA256
4c86bfb2270420abe2bb6a8c77dd7f6ec9480aeaf617187244da3996a2302d36

SHA512
ce8d9b4bbd8989e63d17e72478b2858f8db958ba5d775f35bbf75ab3a4b7b71a0c06a4606013f54aa6a4e8d63009fdfa3dd197fb4f2ab0391452076f27f974d4

Download Submit
memory/2036-5-0x00000000004E0000-0x00000000004E2000-memory.dmp

Filesize
8KB

Download
memory/2036-4-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2036-10-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download