7fc107c4775725fe50a83b9c643bc1b8a115e491e9749668c0afebc41be2a127

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 04:02

Target

aaf40f9c7954bcad8a460d306f3e30f1.exe
Size

191KB
MD5

aaf40f9c7954bcad8a460d306f3e30f1
SHA1

338bb9e4890f99e71e018e08448d6c3e5ea06726
SHA256

7fc107c4775725fe50a83b9c643bc1b8a115e491e9749668c0afebc41be2a127
SHA512

fb0edc19aa4fd3eb172f4faa6fa69b674d2de16db23d89baa6c70d09dba0c92f5673a61948c3272c17ea0016969384a9104e14dc6ecef2d79c279a940e6d8773
SSDEEP

3072:rpv1gcLXpJ8IcWD50nXTCjjOX9x3IZ76w20KxCnZ+Bnf/4BivOZRjJqAlB3v:rVFRcWD50nmqX4ZuwwNHwqOZTj

Score

7^/10

Deletes itself 1 IoCs

pid	Process
472	aaf40f9c7954bcad8a460d306f3e30f1.exe

Executes dropped EXE 1 IoCs

pid	Process
472	aaf40f9c7954bcad8a460d306f3e30f1.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
208	4996	WerFault.exe	85
536	472	WerFault.exe	93

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4996	aaf40f9c7954bcad8a460d306f3e30f1.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
472	aaf40f9c7954bcad8a460d306f3e30f1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 472	4996	aaf40f9c7954bcad8a460d306f3e30f1.exe	93
PID 4996 wrote to memory of 472	4996	aaf40f9c7954bcad8a460d306f3e30f1.exe	93
PID 4996 wrote to memory of 472	4996	aaf40f9c7954bcad8a460d306f3e30f1.exe	93

C:\Users\Admin\AppData\Local\Temp\aaf40f9c7954bcad8a460d306f3e30f1.exe
"C:\Users\Admin\AppData\Local\Temp\aaf40f9c7954bcad8a460d306f3e30f1.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 404
  2⤵
  - Program crash
  PID:208
- C:\Users\Admin\AppData\Local\Temp\aaf40f9c7954bcad8a460d306f3e30f1.exe
  C:\Users\Admin\AppData\Local\Temp\aaf40f9c7954bcad8a460d306f3e30f1.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 472 -s 364
    3⤵
    - Program crash
    PID:536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4996 -ip 4996
1⤵
PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 472 -ip 472
1⤵
PID:4968

C:\Users\Admin\AppData\Local\Temp\aaf40f9c7954bcad8a460d306f3e30f1.exe

Filesize
191KB

MD5
345bf71009aeb9b83fea23683d813bd1

SHA1
6d865f81bbbf85cfa87a10c3c9075a6e03b039c8

SHA256
2a394787ce2d4bd07b879f9dcd4a8b550d877e7ea916d024987e5c8541a534c3

SHA512
a7e4084274ea3ac00ea72cbdc9c1d7b3f7fa3dc25411a869d657acc86343ba32fdce21ba4dd48fac5dcf79cb49e7456c7c831bd735491736e425971aff5ab975

Download Submit
memory/472-7-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/472-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/472-13-0x00000000015B0000-0x00000000015E8000-memory.dmp

Filesize
224KB

Download
memory/4996-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4996-6-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download