0dd5cc51136a1859f138b1a2a7543aed7ff86ad954e3f9306616afe550abede9

Analysis

max time kernel
136s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 16:44

Target

7ac1952964290683b7613aa8ad3e28b1.exe
Size

23KB
MD5

7ac1952964290683b7613aa8ad3e28b1
SHA1

162d180f9b940dcdbc9d30fd1d6f6039c9676d35
SHA256

0dd5cc51136a1859f138b1a2a7543aed7ff86ad954e3f9306616afe550abede9
SHA512

798afe3f968dd8633183a1191f8c4b2604657c3f5cc890af46f123d8101a873638fb4a0eb2cff1f3d16935567a20a93475466e14974c8dad93ea5c3d3f2f7e16
SSDEEP

384:4xtvvQTHkpsm8hNzch3r0OtsqcUSJxp6wABa4l/YJ2lNZKhyDJqZqbVVhDR/mWn:ctvW5/oVr0O6Jp6wABNlzlN2GqAbVVhP

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
4000	7ac1952964290683b7613aa8ad3e28b1.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\windhcp.ocx	7ac1952964290683b7613aa8ad3e28b1.exe
File opened for modification	C:\Windows\SysWOW64\windhcp.ocx	7ac1952964290683b7613aa8ad3e28b1.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3584	4000	WerFault.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4000	7ac1952964290683b7613aa8ad3e28b1.exe
4000	7ac1952964290683b7613aa8ad3e28b1.exe

C:\Users\Admin\AppData\Local\Temp\7ac1952964290683b7613aa8ad3e28b1.exe
"C:\Users\Admin\AppData\Local\Temp\7ac1952964290683b7613aa8ad3e28b1.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 324
  2⤵
  - Program crash
  PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4000 -ip 4000
1⤵
PID:2864

C:\Users\Admin\AppData\Local\Temp\7ac1952964290683b7613aa8ad3e28b1.dat

Filesize
20KB

MD5
389f5ff041d850d6c7deb9e361d44d81

SHA1
59815a8f39f046ad7145465aec92edef75366f04

SHA256
4741ba71298bf36696e2df6cc977f82d9eb6b48f7be2be4dcf127c3a91efeff9

SHA512
a10d54765ed82516922e5b7608791e8985946f729fcb6ad53dd2af65d7995499452163b83743cb2db9cf35afab6f1ccb3d0e502726336350f4d815a730b24c9d

Download Submit
memory/4000-0-0x0000000000400000-0x0000000000412017-memory.dmp

Filesize
72KB

Download
memory/4000-5-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/4000-7-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/4000-12-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/4000-11-0x0000000000400000-0x0000000000412017-memory.dmp

Filesize
72KB

Download