36b5c2f20fb07d361eea9f68b82afe66d38b00ec34fe694e223138ebabc64b49

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 20:29

Target

36b5c2f20fb07d361eea9f68b82afe66d38b00ec34fe694e223138ebabc64b49.exe
Size

213KB
MD5

12e6b01343855b932209a8b216e57b66
SHA1

1fa2d752cedda724b016708be8bc36ac9f96c306
SHA256

36b5c2f20fb07d361eea9f68b82afe66d38b00ec34fe694e223138ebabc64b49
SHA512

0298a82958a6991a42cbe7c5318cbb9de65923cd3401743f05ca335040ac13eeda49ff4e3496b6b743c6d9562b3040d3e7a4f0ad9c28c679c45e1a4346625129
SSDEEP

6144:HEv2c2v/GEtFHQR557j7nR8GhyMgS7tDH0:Uj2v/GEtFQR5BRFlJDH0

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4376	36b5c2f20fb07d361eea9f68b82afe66d38b00ec34fe694e223138ebabc64b49.exe

Executes dropped EXE 1 IoCs

pid	Process
4376	36b5c2f20fb07d361eea9f68b82afe66d38b00ec34fe694e223138ebabc64b49.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2208	3308	WerFault.exe	88
4040	4376	WerFault.exe	96

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3308	36b5c2f20fb07d361eea9f68b82afe66d38b00ec34fe694e223138ebabc64b49.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4376	36b5c2f20fb07d361eea9f68b82afe66d38b00ec34fe694e223138ebabc64b49.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 4376	3308	36b5c2f20fb07d361eea9f68b82afe66d38b00ec34fe694e223138ebabc64b49.exe	96
PID 3308 wrote to memory of 4376	3308	36b5c2f20fb07d361eea9f68b82afe66d38b00ec34fe694e223138ebabc64b49.exe	96
PID 3308 wrote to memory of 4376	3308	36b5c2f20fb07d361eea9f68b82afe66d38b00ec34fe694e223138ebabc64b49.exe	96

C:\Users\Admin\AppData\Local\Temp\36b5c2f20fb07d361eea9f68b82afe66d38b00ec34fe694e223138ebabc64b49.exe
"C:\Users\Admin\AppData\Local\Temp\36b5c2f20fb07d361eea9f68b82afe66d38b00ec34fe694e223138ebabc64b49.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 396
  2⤵
  - Program crash
  PID:2208
- C:\Users\Admin\AppData\Local\Temp\36b5c2f20fb07d361eea9f68b82afe66d38b00ec34fe694e223138ebabc64b49.exe
  C:\Users\Admin\AppData\Local\Temp\36b5c2f20fb07d361eea9f68b82afe66d38b00ec34fe694e223138ebabc64b49.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 364
    3⤵
    - Program crash
    PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3308 -ip 3308
1⤵
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4376 -ip 4376
1⤵
PID:2784

C:\Users\Admin\AppData\Local\Temp\36b5c2f20fb07d361eea9f68b82afe66d38b00ec34fe694e223138ebabc64b49.exe

Filesize
213KB

MD5
54849ee611ba2280bca7e07c32810a56

SHA1
67bcd0f960ea893e9edbaad955320ad874dd602e

SHA256
c6bffe1458b6f2c346c03f1274024837e49e01d6c521333ed4360788ffd5b3d5

SHA512
83ab959b8f5ed58fda4dd9e79156c10c13274a3074e5afa6bee98f04115e2d051e2d31bdade59cda929b9645a44a641b26c5d7d42758ae2649a28b9405636de8

Download Submit
memory/3308-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3308-6-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4376-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4376-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4376-11-0x00000000014D0000-0x0000000001511000-memory.dmp

Filesize
260KB

Download