e0de2bf7ad756a7b789a65d240b5959010d1939c3bf539a9b44e80a6e94e3d06

Analysis

max time kernel
145s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 04:01

Target

4d48a33cf2f03f6cd60e1b12c030c988.exe
Size

239KB
MD5

4d48a33cf2f03f6cd60e1b12c030c988
SHA1

24234fc890d9445f0b09148d93f19a76780c539e
SHA256

e0de2bf7ad756a7b789a65d240b5959010d1939c3bf539a9b44e80a6e94e3d06
SHA512

231c1d9cf3852709696b754476ec74f69935c1f271c9435f5da086f1d807b07635f3c0291e27e45f164cb8a872a6ea204f6d2b5a658a98bd4ee2e828aad9693a
SSDEEP

6144:yxR68/5lVxIMAGLXnul89Mh5rp8x9u4mJgoUe3Ie43YP:ylBlHtAM+cM7q3uFIelP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2816	RemoteAxbc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2816 set thread context of 1196	2816	RemoteAxbc.exe	107

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\RemoteAxbc.exe	4d48a33cf2f03f6cd60e1b12c030c988.exe
File created	C:\Windows\RemoteAxbc.exe	4d48a33cf2f03f6cd60e1b12c030c988.exe

Program crash 1 IoCs

pid	pid_target	Process
2732	1196	WerFault.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 4004	1372	4d48a33cf2f03f6cd60e1b12c030c988.exe	45
PID 1372 wrote to memory of 4004	1372	4d48a33cf2f03f6cd60e1b12c030c988.exe	45
PID 1372 wrote to memory of 4004	1372	4d48a33cf2f03f6cd60e1b12c030c988.exe	45
PID 2816 wrote to memory of 1196	2816	RemoteAxbc.exe	107
PID 2816 wrote to memory of 1196	2816	RemoteAxbc.exe	107
PID 2816 wrote to memory of 1196	2816	RemoteAxbc.exe	107
PID 2816 wrote to memory of 1196	2816	RemoteAxbc.exe	107
PID 2816 wrote to memory of 1196	2816	RemoteAxbc.exe	107

C:\Users\Admin\AppData\Local\Temp\4d48a33cf2f03f6cd60e1b12c030c988.exe
"C:\Users\Admin\AppData\Local\Temp\4d48a33cf2f03f6cd60e1b12c030c988.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\5782.bat
  2⤵
  PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1196 -ip 1196
1⤵
PID:3284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 12
1⤵
- Program crash
PID:2732

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" 60928
1⤵
PID:1196

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv OYEnKgWqc0Cww+th61/93w.0.2
1⤵
PID:1196

C:\Windows\RemoteAxbc.exe

Filesize
239KB

MD5
4d48a33cf2f03f6cd60e1b12c030c988

SHA1
24234fc890d9445f0b09148d93f19a76780c539e

SHA256
e0de2bf7ad756a7b789a65d240b5959010d1939c3bf539a9b44e80a6e94e3d06

SHA512
231c1d9cf3852709696b754476ec74f69935c1f271c9435f5da086f1d807b07635f3c0291e27e45f164cb8a872a6ea204f6d2b5a658a98bd4ee2e828aad9693a

Download Submit
memory/1196-11-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/1372-0-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/1372-1-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Filesize
4KB

Download
memory/1372-3-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/1372-12-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/2816-10-0x0000000000F00000-0x0000000000F01000-memory.dmp

Filesize
4KB

Download
memory/2816-7-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/2816-6-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/2816-14-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download