423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 19:25

Target

423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe
Size

202KB
MD5

3f26270f8b35747e0441c82d5ac8b1ea
SHA1

803a1c575e86e55fbc7d90f782cb3f3b6ac0b1bf
SHA256

423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71
SHA512

6ae3a5b45ba82b001ecdf22e83c3a77f6eb677172f0d8a3b5ec8e5a856e88978f86994575bd0fb21ace1a7353e596ab9d3bdef2aaf09e40e8ee2a3f2411601f4
SSDEEP

3072:l5o6RWcwC6BI70JkbfHUZIcKapBAE6i7UYF2FDgQGHhVvzP:3o6RWc40fzcniE/p2kQG7rP

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2180	423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe

Executes dropped EXE 1 IoCs

pid	Process
2180	423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4012	4048	WerFault.exe	87
4708	2180	WerFault.exe	95

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4048	423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2180	423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 2180	4048	423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe	95
PID 4048 wrote to memory of 2180	4048	423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe	95
PID 4048 wrote to memory of 2180	4048	423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe	95

C:\Users\Admin\AppData\Local\Temp\423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe
"C:\Users\Admin\AppData\Local\Temp\423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 396
  2⤵
  - Program crash
  PID:4012
- C:\Users\Admin\AppData\Local\Temp\423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe
  C:\Users\Admin\AppData\Local\Temp\423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 364
    3⤵
    - Program crash
    PID:4708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4048 -ip 4048
1⤵
PID:1572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2180 -ip 2180
1⤵
PID:3820

C:\Users\Admin\AppData\Local\Temp\423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe

Filesize
202KB

MD5
cf20f2e1dbef508d4218d90012c3a11e

SHA1
d67fb4c6e0d94eac037e648a621bb1fb7f83c14a

SHA256
23b60ddda5915ece057d00ed92cdf61f9217ba948d86a9ca316b95355996a46b

SHA512
d3d5f7db248d2ea2f40c797c83e0e2a2b7f188cdfa0540f28ba15454cf74beb70522ba2fb7b70d6da254ba479b4aea82e03973bef4c5319151d0488790d8c8ca

Download Submit
memory/2180-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2180-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2180-13-0x0000000000150000-0x000000000018E000-memory.dmp

Filesize
248KB

Download
memory/2180-14-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4048-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4048-6-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download