426e7f4d4d4d127fdb841dd14f1ff38c3af09f41f2040990c2154c894a7e0d4f

Analysis

max time kernel
156s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 19:04

Target

426e7f4d4d4d127fdb841dd14f1ff38c3af09f41f2040990c2154c894a7e0d4f.exe
Size

192KB
MD5

3ee9de81669c8fc04fa4377c97bd3703
SHA1

5f6216cced23e7cf46ae12ee443c50bd08c23d98
SHA256

426e7f4d4d4d127fdb841dd14f1ff38c3af09f41f2040990c2154c894a7e0d4f
SHA512

b9b4d98a18550336ebf1f744b073d4f9f14b6562d6459870ffb129dab061604218cabcd721e6d8ff09f290d17d4e1ea237339cabacd6745e081ea696fa22e022
SSDEEP

3072:/3a5GFXTZdEQrTTAfJgrUysBZdBLA2iZSsmlcfRsfy3yNkxkzbUIz8Q:/3aUFD3EMTkxDpBcrXmSfRseyNlP+Q

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4464	426e7f4d4d4d127fdb841dd14f1ff38c3af09f41f2040990c2154c894a7e0d4f.exe

Executes dropped EXE 1 IoCs

pid	Process
4464	426e7f4d4d4d127fdb841dd14f1ff38c3af09f41f2040990c2154c894a7e0d4f.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
3564	3640	WerFault.exe	94
724	4464	WerFault.exe	100
4144	4464	WerFault.exe	100
1660	4464	WerFault.exe	100
3752	4464	WerFault.exe	100

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3640	426e7f4d4d4d127fdb841dd14f1ff38c3af09f41f2040990c2154c894a7e0d4f.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4464	426e7f4d4d4d127fdb841dd14f1ff38c3af09f41f2040990c2154c894a7e0d4f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 4464	3640	426e7f4d4d4d127fdb841dd14f1ff38c3af09f41f2040990c2154c894a7e0d4f.exe	100
PID 3640 wrote to memory of 4464	3640	426e7f4d4d4d127fdb841dd14f1ff38c3af09f41f2040990c2154c894a7e0d4f.exe	100
PID 3640 wrote to memory of 4464	3640	426e7f4d4d4d127fdb841dd14f1ff38c3af09f41f2040990c2154c894a7e0d4f.exe	100

C:\Users\Admin\AppData\Local\Temp\426e7f4d4d4d127fdb841dd14f1ff38c3af09f41f2040990c2154c894a7e0d4f.exe
"C:\Users\Admin\AppData\Local\Temp\426e7f4d4d4d127fdb841dd14f1ff38c3af09f41f2040990c2154c894a7e0d4f.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 384
  2⤵
  - Program crash
  PID:3564
- C:\Users\Admin\AppData\Local\Temp\426e7f4d4d4d127fdb841dd14f1ff38c3af09f41f2040990c2154c894a7e0d4f.exe
  C:\Users\Admin\AppData\Local\Temp\426e7f4d4d4d127fdb841dd14f1ff38c3af09f41f2040990c2154c894a7e0d4f.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 372
    3⤵
    - Program crash
    PID:724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 768
    3⤵
    - Program crash
    PID:4144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 788
    3⤵
    - Program crash
    PID:1660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 796
    3⤵
    - Program crash
    PID:3752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3640 -ip 3640
1⤵
PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4464 -ip 4464
1⤵
PID:2200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3508 --field-trial-handle=3084,i,11997299123381683778,5904351605020331957,262144 --variations-seed-version /prefetch:8
1⤵
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4464 -ip 4464
1⤵
PID:3864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4464 -ip 4464
1⤵
PID:3664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4464 -ip 4464
1⤵
PID:4004

C:\Users\Admin\AppData\Local\Temp\426e7f4d4d4d127fdb841dd14f1ff38c3af09f41f2040990c2154c894a7e0d4f.exe

Filesize
192KB

MD5
7c726c330ee25cfd3dabcd2fec3286f0

SHA1
cdafb70eedca058c82fd59854afb82a472f6ca6c

SHA256
a9537b0f169565d96277fe3b800e72adb34acfa3ea4aaa5a898b72b4abe05521

SHA512
2b9db6562b124e9c6f02b6b7e9527358c5e0d95cfa5072fdaa93c39a0e62c65e7a29119bc773c68acf37d8a8b9dc2ce2f59fa1e5903b91ef6f300e8240b41f92

Download Submit
memory/3640-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3640-6-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4464-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4464-8-0x00000000001C0000-0x00000000001FC000-memory.dmp

Filesize
240KB

Download
memory/4464-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download