326456dd24996db64f367a9033c86b575279bd55ccf4bbb6ab406b659b27fdb3

Analysis

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 07:54

Target

a34264b78e3991af95dbfd722e811a99.exe
Size

27KB
MD5

a34264b78e3991af95dbfd722e811a99
SHA1

050f2bfb5557197e51762fa33bff83e9c9dd4fd9
SHA256

326456dd24996db64f367a9033c86b575279bd55ccf4bbb6ab406b659b27fdb3
SHA512

597d14f8b4dfa1f38bba33eaea55dfba4ec7e5347bb23f82d230394a62d61617a9eb0bfd4c3dcdbd584cc8f5eff277c4e0bd86215a916c16e998f40f238c8458
SSDEEP

768:JdXSoa32rWTHg4vvA0RpKTdapAULKtOHVjE:nXLw2/4HPRpzpAl7

Score

7^/10

Executes dropped EXE 3 IoCs

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\magent.bin	a34264b78e3991af95dbfd722e811a99.exe
File opened for modification	C:\Windows\SysWOW64\magent.bin	a34264b78e3991af95dbfd722e811a99.exe
File created	C:\Windows\SysWOW64\magent.bin	magent.exe
File opened for modification	C:\Windows\SysWOW64\magent.bin	magent.exe
File created	C:\Windows\SysWOW64\magent.bin	magent.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2572	1600	WerFault.exe	87

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 4344	1192	a34264b78e3991af95dbfd722e811a99.exe	85
PID 1192 wrote to memory of 4344	1192	a34264b78e3991af95dbfd722e811a99.exe	85
PID 1192 wrote to memory of 4344	1192	a34264b78e3991af95dbfd722e811a99.exe	85
PID 4344 wrote to memory of 2384	4344	magent.exe	86
PID 4344 wrote to memory of 2384	4344	magent.exe	86
PID 4344 wrote to memory of 2384	4344	magent.exe	86
PID 2384 wrote to memory of 1600	2384	magent.exe	87
PID 2384 wrote to memory of 1600	2384	magent.exe	87
PID 2384 wrote to memory of 1600	2384	magent.exe	87

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1600 -ip 1600
1⤵
PID:3040

C:\Windows\SysWOW64\magent.exe

Filesize
27KB

MD5
a34264b78e3991af95dbfd722e811a99

SHA1
050f2bfb5557197e51762fa33bff83e9c9dd4fd9

SHA256
326456dd24996db64f367a9033c86b575279bd55ccf4bbb6ab406b659b27fdb3

SHA512
597d14f8b4dfa1f38bba33eaea55dfba4ec7e5347bb23f82d230394a62d61617a9eb0bfd4c3dcdbd584cc8f5eff277c4e0bd86215a916c16e998f40f238c8458

Download Submit
memory/1192-0-0x0000000000520000-0x000000000053D000-memory.dmp

Filesize
116KB

Download
memory/1192-1-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1192-7-0x0000000000520000-0x000000000053D000-memory.dmp

Filesize
116KB

Download
memory/1192-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1600-18-0x0000000000020000-0x000000000003A000-memory.dmp

Filesize
104KB

Download
memory/2384-13-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2384-19-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4344-14-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download