313c6327168e995d827db1f1a83093b159331b28395b41c90d7574c8ceace9c5

Analysis

max time kernel
171s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2024 13:59

Target

4929381989370725126a3783d64c90c0.exe
Size

3.5MB
MD5

4929381989370725126a3783d64c90c0
SHA1

027013509f2b7af24352fa63b681d4cd2126d5bd
SHA256

313c6327168e995d827db1f1a83093b159331b28395b41c90d7574c8ceace9c5
SHA512

68a9cc851a8bd67c10bfa46fe5fe3f652679e455d6a2a43fcd5083d09448c318bf453ca0be0d7917a0b1e5a5c2f92dc139ce6be12c46f03d7e080e1370ca6918
SSDEEP

49152:oNDz/YogfniXtXIMfX2wGBDDQ/XSHdX4MPXGg:oRztXtWHd

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4908	4929381989370725126a3783d64c90c0.exe

Executes dropped EXE 1 IoCs

pid	Process
4908	4929381989370725126a3783d64c90c0.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3180	1248	WerFault.exe	87
3608	4908	WerFault.exe	94
2192	4908	WerFault.exe	94

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1248	4929381989370725126a3783d64c90c0.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4908	4929381989370725126a3783d64c90c0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 4908	1248	4929381989370725126a3783d64c90c0.exe	94
PID 1248 wrote to memory of 4908	1248	4929381989370725126a3783d64c90c0.exe	94
PID 1248 wrote to memory of 4908	1248	4929381989370725126a3783d64c90c0.exe	94

C:\Users\Admin\AppData\Local\Temp\4929381989370725126a3783d64c90c0.exe
"C:\Users\Admin\AppData\Local\Temp\4929381989370725126a3783d64c90c0.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 344
  2⤵
  - Program crash
  PID:3180
- C:\Users\Admin\AppData\Local\Temp\4929381989370725126a3783d64c90c0.exe
  C:\Users\Admin\AppData\Local\Temp\4929381989370725126a3783d64c90c0.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 344
    3⤵
    - Program crash
    PID:3608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 344
    3⤵
    - Program crash
    PID:2192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1248 -ip 1248
1⤵
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4908 -ip 4908
1⤵
PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4908 -ip 4908
1⤵
PID:1760

C:\Users\Admin\AppData\Local\Temp\4929381989370725126a3783d64c90c0.exe

Filesize
327KB

MD5
1a5df4252f76d20d8a125a658d769c71

SHA1
8cc3c540f2834c9e5f0df56aed95e84f5dc6bc83

SHA256
695be78909f29049c8af2dbc57ab57fca8d8b823b1f773eb29e9e260aba32726

SHA512
bddc78ce59ed65e69a40ed9df5e399f8713bb4138fb1ff6cfe36a4b02d79681b802e3c2229b1df6e98b99b966a366a0027e1acf662fa3f966974c83016de2c0a

Download Submit
memory/1248-0-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/1248-6-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/4908-7-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/4908-8-0x0000000004F60000-0x0000000005045000-memory.dmp

Filesize
916KB

Download
memory/4908-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download