b36657ac328849497aa1afffbd01c21374c8bc7ac821ecc843c68e91e74998a4

Analysis

max time kernel
140s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 00:13

Target

b36657ac328849497aa1afffbd01c21374c8bc7ac821ecc843c68e91e74998a4.exe
Size

448KB
MD5

e786e9c00c9461f5b2f418fcc7bc2dfb
SHA1

91555166f985f321bf2ee0775fc9dad8c3f24626
SHA256

b36657ac328849497aa1afffbd01c21374c8bc7ac821ecc843c68e91e74998a4
SHA512

fb146331fa55679b850d3899413e84376fce6d4d03ddcef8e3623f070836915c27b3ce88c0c88cf4a87e06e0b18bda2bde1320db51bf16c297ebfcd109f4ca74
SSDEEP

12288:RyZE1xxolX33HVIq4DOQS7wEqZQ0npM4dl0v5JdmY:8ZE13olX33HVIq4DOQS7wEqZQEM4dmvN

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3800	b36657ac328849497aa1afffbd01c21374c8bc7ac821ecc843c68e91e74998a4.exe

Executes dropped EXE 1 IoCs

pid	Process
3800	b36657ac328849497aa1afffbd01c21374c8bc7ac821ecc843c68e91e74998a4.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
4512	2028	WerFault.exe	86
2272	3800	WerFault.exe	96
2160	3800	WerFault.exe	96
4092	3800	WerFault.exe	96
1008	3800	WerFault.exe	96

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2028	b36657ac328849497aa1afffbd01c21374c8bc7ac821ecc843c68e91e74998a4.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3800	b36657ac328849497aa1afffbd01c21374c8bc7ac821ecc843c68e91e74998a4.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 3800	2028	b36657ac328849497aa1afffbd01c21374c8bc7ac821ecc843c68e91e74998a4.exe	96
PID 2028 wrote to memory of 3800	2028	b36657ac328849497aa1afffbd01c21374c8bc7ac821ecc843c68e91e74998a4.exe	96
PID 2028 wrote to memory of 3800	2028	b36657ac328849497aa1afffbd01c21374c8bc7ac821ecc843c68e91e74998a4.exe	96

C:\Users\Admin\AppData\Local\Temp\b36657ac328849497aa1afffbd01c21374c8bc7ac821ecc843c68e91e74998a4.exe
"C:\Users\Admin\AppData\Local\Temp\b36657ac328849497aa1afffbd01c21374c8bc7ac821ecc843c68e91e74998a4.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 356
  2⤵
  - Program crash
  PID:4512
- C:\Users\Admin\AppData\Local\Temp\b36657ac328849497aa1afffbd01c21374c8bc7ac821ecc843c68e91e74998a4.exe
  C:\Users\Admin\AppData\Local\Temp\b36657ac328849497aa1afffbd01c21374c8bc7ac821ecc843c68e91e74998a4.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 352
    3⤵
    - Program crash
    PID:2272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 768
    3⤵
    - Program crash
    PID:2160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 772
    3⤵
    - Program crash
    PID:4092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 768
    3⤵
    - Program crash
    PID:1008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2028 -ip 2028
1⤵
PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3800 -ip 3800
1⤵
PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3800 -ip 3800
1⤵
PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3800 -ip 3800
1⤵
PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3800 -ip 3800
1⤵
PID:4796

C:\Users\Admin\AppData\Local\Temp\b36657ac328849497aa1afffbd01c21374c8bc7ac821ecc843c68e91e74998a4.exe

Filesize
448KB

MD5
90b66805f54052d05d11398861afe2a7

SHA1
6fbda5e779ba7e5c7f6d6860a332533933af398f

SHA256
49478e7e9c9d66cb216d00dfffda87f3823118889cfd40db3e0575dbe88614f5

SHA512
5dda932c4ce9d9a277407227ec2090c581d2c19f16cc863f54fe86da497a1d984e41b2231e1a51c627fb11b284d587686c4ae1df2d20a9364910d22e3a8074ac

Download Submit
memory/2028-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2028-1-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2028-7-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3800-8-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3800-9-0x00000000014F0000-0x0000000001528000-memory.dmp

Filesize
224KB

Download
memory/3800-10-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download