2c01b1fb861bfa4d0d5ae08b9935bbe1c177b79539482418a639fd08dc525c04

Analysis

max time kernel
131s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 18:35

Target

2c01b1fb861bfa4d0d5ae08b9935bbe1c177b79539482418a639fd08dc525c04.exe
Size

192KB
MD5

94f19e345ff1adbae4ed30f5703fe8ad
SHA1

1ff2d5bc5a3677dcb76d3030ee77e20e96693b01
SHA256

2c01b1fb861bfa4d0d5ae08b9935bbe1c177b79539482418a639fd08dc525c04
SHA512

be1b45ae754393f1d20bafecfe275ecc31dce75fc2ddea1190f0edd520198c2c57e4245bb0c20b8603bbd6ae12a89db8ce3d3b3c4a7922c0e5d4a34c0e18d6a0
SSDEEP

3072:LW0sg7LQhjLiX95F5V/bYx9jyAbMxqUw7rFl+XGFumnRkE96xkzbUIz8Q:60z7LEjWB5FIjy8MxRIZl6mnRFdP+Q

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2884	2c01b1fb861bfa4d0d5ae08b9935bbe1c177b79539482418a639fd08dc525c04.exe

Executes dropped EXE 1 IoCs

pid	Process
2884	2c01b1fb861bfa4d0d5ae08b9935bbe1c177b79539482418a639fd08dc525c04.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
1604	4800	WerFault.exe	93
4896	2884	WerFault.exe	101
4296	2884	WerFault.exe	101
4080	2884	WerFault.exe	101
1332	2884	WerFault.exe	101

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4800	2c01b1fb861bfa4d0d5ae08b9935bbe1c177b79539482418a639fd08dc525c04.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2884	2c01b1fb861bfa4d0d5ae08b9935bbe1c177b79539482418a639fd08dc525c04.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 2884	4800	2c01b1fb861bfa4d0d5ae08b9935bbe1c177b79539482418a639fd08dc525c04.exe	101
PID 4800 wrote to memory of 2884	4800	2c01b1fb861bfa4d0d5ae08b9935bbe1c177b79539482418a639fd08dc525c04.exe	101
PID 4800 wrote to memory of 2884	4800	2c01b1fb861bfa4d0d5ae08b9935bbe1c177b79539482418a639fd08dc525c04.exe	101

C:\Users\Admin\AppData\Local\Temp\2c01b1fb861bfa4d0d5ae08b9935bbe1c177b79539482418a639fd08dc525c04.exe
"C:\Users\Admin\AppData\Local\Temp\2c01b1fb861bfa4d0d5ae08b9935bbe1c177b79539482418a639fd08dc525c04.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 356
  2⤵
  - Program crash
  PID:1604
- C:\Users\Admin\AppData\Local\Temp\2c01b1fb861bfa4d0d5ae08b9935bbe1c177b79539482418a639fd08dc525c04.exe
  C:\Users\Admin\AppData\Local\Temp\2c01b1fb861bfa4d0d5ae08b9935bbe1c177b79539482418a639fd08dc525c04.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 352
    3⤵
    - Program crash
    PID:4896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 768
    3⤵
    - Program crash
    PID:4296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 788
    3⤵
    - Program crash
    PID:4080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 796
    3⤵
    - Program crash
    PID:1332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4800 -ip 4800
1⤵
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2884 -ip 2884
1⤵
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2884 -ip 2884
1⤵
PID:2568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2884 -ip 2884
1⤵
PID:3044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1400 --field-trial-handle=2432,i,12161922670941700748,3348345705955601576,262144 --variations-seed-version /prefetch:8
1⤵
PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2884 -ip 2884
1⤵
PID:4620

C:\Users\Admin\AppData\Local\Temp\2c01b1fb861bfa4d0d5ae08b9935bbe1c177b79539482418a639fd08dc525c04.exe

Filesize
192KB

MD5
6aefdba9f1cdbbb7d521b228088ae4d3

SHA1
730898757f204b6c27f697a52a12a77c583d9afe

SHA256
a7901f724847d20cce817f8489261638b4528c77bd04060118d986aa1f3e62e6

SHA512
da8043f5785290ba283068edd545dabe13058ac08cf64427d1dc311f420208b14f51cfa5c14cec52475f52eb40cfaf11dd5a32c23514556e8c869144e9f7e7f9

Download Submit
memory/2884-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2884-8-0x0000000003D90000-0x0000000003DCC000-memory.dmp

Filesize
240KB

Download
memory/2884-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4800-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4800-6-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download