f2203d52eeaaef8f178d4869701c3f919d438f6a4468254e91400ec72cead426

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 03:37

Target

0d30182fa19e0264fefd3c817ef90a8a.exe
Size

36KB
MD5

0d30182fa19e0264fefd3c817ef90a8a
SHA1

ba7195ddbb5552d4d0210c5add66fbcfb63e0f5f
SHA256

f2203d52eeaaef8f178d4869701c3f919d438f6a4468254e91400ec72cead426
SHA512

1fcacbe73504c6dd055e625ef676479e897e0dcb341334a98e6ace661d605a23ae51926802306207a8f5fb7bd92a21bc13aa85256ed3ae55b817bac53fd991b1
SSDEEP

768:8ZxO3SQge7fDjpSVho/GJf1WLBdkOZx3YvN4BXHimS+i:8TSLlbOJf1QwuxovaXH4+i

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\csrss.exe	0d30182fa19e0264fefd3c817ef90a8a.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4272	4692	WerFault.exe	88

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4692	0d30182fa19e0264fefd3c817ef90a8a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 3228	4692	0d30182fa19e0264fefd3c817ef90a8a.exe	95
PID 4692 wrote to memory of 3228	4692	0d30182fa19e0264fefd3c817ef90a8a.exe	95
PID 4692 wrote to memory of 3228	4692	0d30182fa19e0264fefd3c817ef90a8a.exe	95

C:\Users\Admin\AppData\Local\Temp\0d30182fa19e0264fefd3c817ef90a8a.exe
"C:\Users\Admin\AppData\Local\Temp\0d30182fa19e0264fefd3c817ef90a8a.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 220
  2⤵
  - Program crash
  PID:4272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\0d30182fa19e0264fefd3c817ef90a8a.bat
  2⤵
  PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4692 -ip 4692
1⤵
PID:3240

C:\Users\Admin\AppData\Local\Temp\0d30182fa19e0264fefd3c817ef90a8a.bat

Filesize
254B

MD5
7473f30590e7f33980ffc08fa07874e0

SHA1
c676612ab5e098c76e45eae6cda3cc9cda8c1cc9

SHA256
252f4a11d8cccaaf51f424544404998ce12fb8445ff477eb60404e9b43f2cdef

SHA512
301cf6cad6fd92594f57194d73c063a2a69dcbcd360b074b8f19bfd9e98767b4df43add3a07a288d53123bc5fa1091c24994bf26a7f0f39db15e3e80a9678c45

Download Submit
C:\Windows\csrss.exe

Filesize
41KB

MD5
b034449dea34e6c5636a4258aeefdf51

SHA1
afbe09c500e97b2c2de3dbf825278adc339be87b

SHA256
4b9bd23ef2d9f45c2f5d58dd15d43f14ad6ed9fa1f84abc3260729a8549635db

SHA512
afb4b5bfaa1ff181708cae4d6a1f108ca1c02ab92a9143608fae8553924e2acc5ff4fec07c6d12e33b9ccd8a2f6223787bbc227a40362722d43f777ea2349893

Download Submit
memory/4692-11-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download