e26c482af6493a1ad601dabc6432249191600138f94cd7b84410373e699c0657

Analysis

max time kernel
144s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2024 13:02

Target

4e5f0a8f4d9b6ce36593a6f10f0130f9.exe
Size

278KB
MD5

4e5f0a8f4d9b6ce36593a6f10f0130f9
SHA1

69aec2e7204fa82c1162c0c57d634e2f8f7c193e
SHA256

e26c482af6493a1ad601dabc6432249191600138f94cd7b84410373e699c0657
SHA512

212382d3b4ed5f69c4e05693e46c2a45f8970397535f38b8e851da272e040b53fbfba45448d56f8f5f18b5581c9ba683ddb5cf7cf39afbc305d03628608549c7
SSDEEP

6144:wRyiL+r5DpMFiKwa1YsOIkSt+W/vK7AlN5I+TpnNrF9H:XiL+XG7hODk/i7AlN5TF

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Saga.sys	4e5f0a8f4d9b6ce36593a6f10f0130f9.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1940	2532	WerFault.exe	30

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

C:\Users\Admin\AppData\Local\Temp\4e5f0a8f4d9b6ce36593a6f10f0130f9.exe
"C:\Users\Admin\AppData\Local\Temp\4e5f0a8f4d9b6ce36593a6f10f0130f9.exe"
1⤵
- Drops file in System32 directory
PID:2532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 340
  2⤵
  - Program crash
  PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2532 -ip 2532
1⤵
PID:4772

memory/2532-0-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2532-2-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download