d9c75be028ad5eec4899f9671628bd74309ab27b6c2271da926862b20b6508e7

Analysis

max time kernel
139s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2024 23:34

Target

d9c75be028ad5eec4899f9671628bd74309ab27b6c2271da926862b20b6508e7.exe
Size

209KB
MD5

8d7d6126837bc9729ccf44e3e066f750
SHA1

55539b0d9b0d1baeb89df4ad15a27bf749211844
SHA256

d9c75be028ad5eec4899f9671628bd74309ab27b6c2271da926862b20b6508e7
SHA512

258cb944666e91a792b9408402855f690584b94352285c05bef11db67c5aa2c4204e0f106b84594ebde0fd750f975b650968b2a3bd761e0b04e79943ad4792fd
SSDEEP

6144:25GgJgBhFkp01VcNliLcKQ8tqHz3I/CqtfXp:AGtn1VK8LcJ8tqHz+Cqtfp

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3920	d9c75be028ad5eec4899f9671628bd74309ab27b6c2271da926862b20b6508e7.exe

Executes dropped EXE 1 IoCs

pid	Process
3920	d9c75be028ad5eec4899f9671628bd74309ab27b6c2271da926862b20b6508e7.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1052	4944	WerFault.exe	87
1580	3920	WerFault.exe	96

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4944	d9c75be028ad5eec4899f9671628bd74309ab27b6c2271da926862b20b6508e7.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3920	d9c75be028ad5eec4899f9671628bd74309ab27b6c2271da926862b20b6508e7.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 3920	4944	d9c75be028ad5eec4899f9671628bd74309ab27b6c2271da926862b20b6508e7.exe	96
PID 4944 wrote to memory of 3920	4944	d9c75be028ad5eec4899f9671628bd74309ab27b6c2271da926862b20b6508e7.exe	96
PID 4944 wrote to memory of 3920	4944	d9c75be028ad5eec4899f9671628bd74309ab27b6c2271da926862b20b6508e7.exe	96

C:\Users\Admin\AppData\Local\Temp\d9c75be028ad5eec4899f9671628bd74309ab27b6c2271da926862b20b6508e7.exe
"C:\Users\Admin\AppData\Local\Temp\d9c75be028ad5eec4899f9671628bd74309ab27b6c2271da926862b20b6508e7.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 396
  2⤵
  - Program crash
  PID:1052
- C:\Users\Admin\AppData\Local\Temp\d9c75be028ad5eec4899f9671628bd74309ab27b6c2271da926862b20b6508e7.exe
  C:\Users\Admin\AppData\Local\Temp\d9c75be028ad5eec4899f9671628bd74309ab27b6c2271da926862b20b6508e7.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 364
    3⤵
    - Program crash
    PID:1580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4944 -ip 4944
1⤵
PID:728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3920 -ip 3920
1⤵
PID:4172

C:\Users\Admin\AppData\Local\Temp\d9c75be028ad5eec4899f9671628bd74309ab27b6c2271da926862b20b6508e7.exe

Filesize
209KB

MD5
979d348002ca22c684cdf1170730bdc2

SHA1
a271a9f8a914466a770bed70f504394536e64db6

SHA256
c0185e701f2c38c2fac2430f073288912ceb755ec4bf0b053866576d8917273e

SHA512
92bf05fe69d5278a26daf5b525864c8d0b5db1185ccbf30943cf3409b1076e59f9e5230a9e84b5bac2ff8ca49c3d1a64d78f6c4bbb581201b175b8e71069efac

Download Submit
memory/3920-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3920-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3920-13-0x0000000001450000-0x0000000001490000-memory.dmp

Filesize
256KB

Download
memory/4944-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4944-5-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download