b7d909fe4eb0e80f5a57b1d314938b7a15872d83da7719ad9ea7c4334c95c322

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 01:25

Target

b7d909fe4eb0e80f5a57b1d314938b7a15872d83da7719ad9ea7c4334c95c322.exe
Size

223KB
MD5

161f0303a31dbef78a60577592535867
SHA1

90e141b2d248dd5fbf4b6b607d9c876689c85079
SHA256

b7d909fe4eb0e80f5a57b1d314938b7a15872d83da7719ad9ea7c4334c95c322
SHA512

89a33f9b52ef4ac6d825377e869ae2b0d1802bc847f8cb5614ef225744d8d1039f9e874a1e7c39230b57a0e9e878bb26df3ae26ca7bbbbe377cfca289115a81f
SSDEEP

6144:FPD4YjSi6V05hABA5bum55hg556hiQNO0WP:Fb4YWVV04mvdniQNO0WP

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4928	b7d909fe4eb0e80f5a57b1d314938b7a15872d83da7719ad9ea7c4334c95c322.exe

Executes dropped EXE 1 IoCs

pid	Process
4928	b7d909fe4eb0e80f5a57b1d314938b7a15872d83da7719ad9ea7c4334c95c322.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
868	1556	WerFault.exe	88
4256	4928	WerFault.exe	96

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1556	b7d909fe4eb0e80f5a57b1d314938b7a15872d83da7719ad9ea7c4334c95c322.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4928	b7d909fe4eb0e80f5a57b1d314938b7a15872d83da7719ad9ea7c4334c95c322.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 4928	1556	b7d909fe4eb0e80f5a57b1d314938b7a15872d83da7719ad9ea7c4334c95c322.exe	96
PID 1556 wrote to memory of 4928	1556	b7d909fe4eb0e80f5a57b1d314938b7a15872d83da7719ad9ea7c4334c95c322.exe	96
PID 1556 wrote to memory of 4928	1556	b7d909fe4eb0e80f5a57b1d314938b7a15872d83da7719ad9ea7c4334c95c322.exe	96

C:\Users\Admin\AppData\Local\Temp\b7d909fe4eb0e80f5a57b1d314938b7a15872d83da7719ad9ea7c4334c95c322.exe
"C:\Users\Admin\AppData\Local\Temp\b7d909fe4eb0e80f5a57b1d314938b7a15872d83da7719ad9ea7c4334c95c322.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 396
  2⤵
  - Program crash
  PID:868
- C:\Users\Admin\AppData\Local\Temp\b7d909fe4eb0e80f5a57b1d314938b7a15872d83da7719ad9ea7c4334c95c322.exe
  C:\Users\Admin\AppData\Local\Temp\b7d909fe4eb0e80f5a57b1d314938b7a15872d83da7719ad9ea7c4334c95c322.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 364
    3⤵
    - Program crash
    PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1556 -ip 1556
1⤵
PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4928 -ip 4928
1⤵
PID:3120

C:\Users\Admin\AppData\Local\Temp\b7d909fe4eb0e80f5a57b1d314938b7a15872d83da7719ad9ea7c4334c95c322.exe

Filesize
223KB

MD5
555b2f6752bee62f54984991e10e9569

SHA1
1ce93509c6414a08476333eda53996f7b2fb78ba

SHA256
67e9dd69bd723fedd3858a90cdd0ba4708af0378c275dac548a34b5421fe9bfb

SHA512
a0e6c501a5329e8074fc946284a453f22e3a3a4da905cc94ff3f8758fc71a64a8908c00b96aa20db7215ec9c699822463ecad8268ea218f868d00a7fd6fe703f

Download Submit
memory/1556-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1556-6-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4928-7-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4928-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4928-13-0x0000000004DF0000-0x0000000004E36000-memory.dmp

Filesize
280KB

Download
memory/4928-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download