5b3437a5bb97a17aac7abd8bdf4d672875a21547b250b1d85b2986941bd77c4e

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 06:27

Target

5b3437a5bb97a17aac7abd8bdf4d672875a21547b250b1d85b2986941bd77c4e.exe
Size

362KB
MD5

3cb66373985f1e9a4914a4904e59e640
SHA1

c059a7b88432b6760c6d029612d8dd7d16e15210
SHA256

5b3437a5bb97a17aac7abd8bdf4d672875a21547b250b1d85b2986941bd77c4e
SHA512

a22b19ad803f12940552b65e13e007f129610d197e0813e85104d87beb4068b1a57f8924812b2a60a0487b2eb95733f8a564f0da213960359f00ea9fb0a7a460
SSDEEP

6144:6H5ZwBFG1urgNcxQ+AJv3/zeb/WRIHDXv2k/JrAV40saiigCUlhu9a6r/V:+wBFOohrA93re7V/2qJrAVQ5zCUlh+ay

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3232	5b3437a5bb97a17aac7abd8bdf4d672875a21547b250b1d85b2986941bd77c4e.exe

Executes dropped EXE 1 IoCs

pid	Process
3232	5b3437a5bb97a17aac7abd8bdf4d672875a21547b250b1d85b2986941bd77c4e.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2432	4488	WerFault.exe	93
4840	3232	WerFault.exe	101

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4488	5b3437a5bb97a17aac7abd8bdf4d672875a21547b250b1d85b2986941bd77c4e.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3232	5b3437a5bb97a17aac7abd8bdf4d672875a21547b250b1d85b2986941bd77c4e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 3232	4488	5b3437a5bb97a17aac7abd8bdf4d672875a21547b250b1d85b2986941bd77c4e.exe	101
PID 4488 wrote to memory of 3232	4488	5b3437a5bb97a17aac7abd8bdf4d672875a21547b250b1d85b2986941bd77c4e.exe	101
PID 4488 wrote to memory of 3232	4488	5b3437a5bb97a17aac7abd8bdf4d672875a21547b250b1d85b2986941bd77c4e.exe	101

C:\Users\Admin\AppData\Local\Temp\5b3437a5bb97a17aac7abd8bdf4d672875a21547b250b1d85b2986941bd77c4e.exe
"C:\Users\Admin\AppData\Local\Temp\5b3437a5bb97a17aac7abd8bdf4d672875a21547b250b1d85b2986941bd77c4e.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 404
  2⤵
  - Program crash
  PID:2432
- C:\Users\Admin\AppData\Local\Temp\5b3437a5bb97a17aac7abd8bdf4d672875a21547b250b1d85b2986941bd77c4e.exe
  C:\Users\Admin\AppData\Local\Temp\5b3437a5bb97a17aac7abd8bdf4d672875a21547b250b1d85b2986941bd77c4e.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 364
    3⤵
    - Program crash
    PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4488 -ip 4488
1⤵
PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3232 -ip 3232
1⤵
PID:788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3832 --field-trial-handle=3136,i,3192284747741020952,1225278682167953346,262144 --variations-seed-version /prefetch:8
1⤵
PID:3768

C:\Users\Admin\AppData\Local\Temp\5b3437a5bb97a17aac7abd8bdf4d672875a21547b250b1d85b2986941bd77c4e.exe

Filesize
362KB

MD5
c6f55cba62cecbb8006f59fe91569bd2

SHA1
7cfb08512978487098fee52664e414d773cab52c

SHA256
33a91ec91b48f6c75ccbf7c465d0d2adc5661c58c573a9babaf26b530c98f867

SHA512
0aa6f8fd8e62a14d3832af8bc15e5e58b77ee6080051858726bc944eec5c27f209fd48df3ed05ebb16c4760fd4bf4df40c958d8355c504341bc0744e1acb7099

Download Submit
memory/3232-7-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3232-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3232-10-0x00000000014C0000-0x0000000001503000-memory.dmp

Filesize
268KB

Download
memory/3232-14-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4488-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4488-6-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download