ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3

Analysis

max time kernel
151s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 01:13

Target

ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe
Size

448KB
MD5

23a6a4f6dfc1afad891316e24a4894a1
SHA1

65f67162cb17103ab48844e8e4c59ae9c1c40466
SHA256

ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3
SHA512

00f7d255119d74728b7d0286fe6eca2ebcbf1a77c33f566c1f85f99e90203469656769a5c937ba6515f3571f493762bd883614fa8153ec1b4d31b8bd48228e85
SSDEEP

12288:Vm0NyXgC8FoCNXSNpCyfi0npM4dl0v5JdmA:VPNywC8CCUNpCyfiEM4dmv5r

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4312	ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe

Executes dropped EXE 1 IoCs

pid	Process
4312	ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
4844	348	WerFault.exe	86
2780	4312	WerFault.exe	92
872	4312	WerFault.exe	92
3016	4312	WerFault.exe	92
4660	4312	WerFault.exe	92

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
348	ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4312	ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 348 wrote to memory of 4312	348	ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe	92
PID 348 wrote to memory of 4312	348	ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe	92
PID 348 wrote to memory of 4312	348	ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe	92

C:\Users\Admin\AppData\Local\Temp\ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe
"C:\Users\Admin\AppData\Local\Temp\ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 388
  2⤵
  - Program crash
  PID:4844
- C:\Users\Admin\AppData\Local\Temp\ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe
  C:\Users\Admin\AppData\Local\Temp\ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 352
    3⤵
    - Program crash
    PID:2780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 768
    3⤵
    - Program crash
    PID:872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 772
    3⤵
    - Program crash
    PID:3016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 768
    3⤵
    - Program crash
    PID:4660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 348 -ip 348
1⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4312 -ip 4312
1⤵
PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4312 -ip 4312
1⤵
PID:496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4312 -ip 4312
1⤵
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4312 -ip 4312
1⤵
PID:4280

C:\Users\Admin\AppData\Local\Temp\ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe

Filesize
448KB

MD5
43d3aa9fa6ac6d4511e9aec618e42a8d

SHA1
f1ee64875c19eae77fee59a47385aa0bfc787e31

SHA256
fb3cfc18431012f593e94c7a92772612c94e7d00a4aad089cba82f0663360526

SHA512
50b76e4714e8e836cc97e90cb045c777c3fd9e8486571c6e4c4debdd86a7960e1dfa443692fcaddd90c4ced8833ff7e7f29172cad95a94957fad3122811148b9

Download Submit
memory/348-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/348-6-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4312-7-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4312-8-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/4312-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4312-14-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download