bb12ed93b25e73d7182542b6fa3134a4e8a6a27d64146830e88abaf884531f01

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 01:33

Target

bb12ed93b25e73d7182542b6fa3134a4e8a6a27d64146830e88abaf884531f01.exe
Size

256KB
MD5

196536a0faf1320fbbca5e8e28aa5bc0
SHA1

2ac9b0a0eb11574bac8f676d7134692f7fd059f4
SHA256

bb12ed93b25e73d7182542b6fa3134a4e8a6a27d64146830e88abaf884531f01
SHA512

a962daf042c6ebaafe09fcc46c1abb855bd192c054d1dcedeab4e0d962776ac297e5669e3c358f3569ca12e6b4c1aa68f3bcdbc415fcb3020927e24f99869f52
SSDEEP

6144:47J5T9bhErTJhfB3nFky6QVMv75T2FhE/BzRtIdVv/hQZiSCCO53BDu0W7cyqCxL:cUXbBXFk7v75zBzRtkVv/hQZOCO53p8x

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3700	bb12ed93b25e73d7182542b6fa3134a4e8a6a27d64146830e88abaf884531f01.exe

Executes dropped EXE 1 IoCs

pid	Process
3700	bb12ed93b25e73d7182542b6fa3134a4e8a6a27d64146830e88abaf884531f01.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
1952	4852	WerFault.exe	87
636	3700	WerFault.exe	94
216	3700	WerFault.exe	94
3172	3700	WerFault.exe	94
4848	3700	WerFault.exe	94

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4852	bb12ed93b25e73d7182542b6fa3134a4e8a6a27d64146830e88abaf884531f01.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3700	bb12ed93b25e73d7182542b6fa3134a4e8a6a27d64146830e88abaf884531f01.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 3700	4852	bb12ed93b25e73d7182542b6fa3134a4e8a6a27d64146830e88abaf884531f01.exe	94
PID 4852 wrote to memory of 3700	4852	bb12ed93b25e73d7182542b6fa3134a4e8a6a27d64146830e88abaf884531f01.exe	94
PID 4852 wrote to memory of 3700	4852	bb12ed93b25e73d7182542b6fa3134a4e8a6a27d64146830e88abaf884531f01.exe	94

C:\Users\Admin\AppData\Local\Temp\bb12ed93b25e73d7182542b6fa3134a4e8a6a27d64146830e88abaf884531f01.exe
"C:\Users\Admin\AppData\Local\Temp\bb12ed93b25e73d7182542b6fa3134a4e8a6a27d64146830e88abaf884531f01.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 356
  2⤵
  - Program crash
  PID:1952
- C:\Users\Admin\AppData\Local\Temp\bb12ed93b25e73d7182542b6fa3134a4e8a6a27d64146830e88abaf884531f01.exe
  C:\Users\Admin\AppData\Local\Temp\bb12ed93b25e73d7182542b6fa3134a4e8a6a27d64146830e88abaf884531f01.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 352
    3⤵
    - Program crash
    PID:636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 768
    3⤵
    - Program crash
    PID:216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 544
    3⤵
    - Program crash
    PID:3172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 816
    3⤵
    - Program crash
    PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4852 -ip 4852
1⤵
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3700 -ip 3700
1⤵
PID:3328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3700 -ip 3700
1⤵
PID:2536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3700 -ip 3700
1⤵
PID:1884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3700 -ip 3700
1⤵
PID:4468

C:\Users\Admin\AppData\Local\Temp\bb12ed93b25e73d7182542b6fa3134a4e8a6a27d64146830e88abaf884531f01.exe

Filesize
256KB

MD5
dd244172cf2d71e4d6c1e87a291b2769

SHA1
7f8bb45aff682ec613da1bd7968087e13fd50b80

SHA256
95cc53d91c2fc3330f4e1b282e0f4facc9998556c74e2063c103c84e30106d30

SHA512
e793c81075d47a3982fc37af1f03d85a2b63c9aec229a50029cd67b54bec4bb6abcc34335b4f1c2242292d8cf130f7b0bedc7b1345344c31fd9f629d91562487

Download Submit
memory/3700-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3700-8-0x0000000001510000-0x000000000154C000-memory.dmp

Filesize
240KB

Download
memory/3700-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4852-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4852-6-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download