ab344f1d6e8ca05a1354921d152d9386b3d0b8d1417174d75260d706378a3631

Analysis

max time kernel
144s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 08:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ab344f1d6e8ca05a1354921d152d9386b3d0b8d1417174d75260d706378a3631.exe
Size

448KB
MD5

e651b941d75ee98e8f2d38a3819fff33
SHA1

287fddf810ff133877bbac1859916010a207f283
SHA256

ab344f1d6e8ca05a1354921d152d9386b3d0b8d1417174d75260d706378a3631
SHA512

12c6cbf0857a166752894cdc527deef99bc879493c71902f807d7c29d4df5ecb4da09012a8262320d6336821d5edf2ad611af12fdfca5d0b53990cd2cf54d105
SSDEEP

12288:y5pus041AU/YKN6mKLS53p80npM4dl0v5Jdmo:6us041AmxEmKS53p8EM4dmv5L

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4740	ab344f1d6e8ca05a1354921d152d9386b3d0b8d1417174d75260d706378a3631.exe

Executes dropped EXE 1 IoCs

pid	Process
4740	ab344f1d6e8ca05a1354921d152d9386b3d0b8d1417174d75260d706378a3631.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
2312	1000	WerFault.exe	94
3224	4740	WerFault.exe	101
1004	4740	WerFault.exe	101
548	4740	WerFault.exe	101
2564	4740	WerFault.exe	101
936	4740	WerFault.exe	101
4272	4740	WerFault.exe	101

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1000	ab344f1d6e8ca05a1354921d152d9386b3d0b8d1417174d75260d706378a3631.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4740	ab344f1d6e8ca05a1354921d152d9386b3d0b8d1417174d75260d706378a3631.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 4740	1000	ab344f1d6e8ca05a1354921d152d9386b3d0b8d1417174d75260d706378a3631.exe	101
PID 1000 wrote to memory of 4740	1000	ab344f1d6e8ca05a1354921d152d9386b3d0b8d1417174d75260d706378a3631.exe	101
PID 1000 wrote to memory of 4740	1000	ab344f1d6e8ca05a1354921d152d9386b3d0b8d1417174d75260d706378a3631.exe	101

C:\Users\Admin\AppData\Local\Temp\ab344f1d6e8ca05a1354921d152d9386b3d0b8d1417174d75260d706378a3631.exe
"C:\Users\Admin\AppData\Local\Temp\ab344f1d6e8ca05a1354921d152d9386b3d0b8d1417174d75260d706378a3631.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 384
  2⤵
  - Program crash
  PID:2312
- C:\Users\Admin\AppData\Local\Temp\ab344f1d6e8ca05a1354921d152d9386b3d0b8d1417174d75260d706378a3631.exe
  C:\Users\Admin\AppData\Local\Temp\ab344f1d6e8ca05a1354921d152d9386b3d0b8d1417174d75260d706378a3631.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 352
    3⤵
    - Program crash
    PID:3224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 768
    3⤵
    - Program crash
    PID:1004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 772
    3⤵
    - Program crash
    PID:548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 768
    3⤵
    - Program crash
    PID:2564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 808
    3⤵
    - Program crash
    PID:936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 784
    3⤵
    - Program crash
    PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1000 -ip 1000
1⤵
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4740 -ip 4740
1⤵
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4740 -ip 4740
1⤵
PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4740 -ip 4740
1⤵
PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=3084,i,14217130992253490921,11543335378077656547,262144 --variations-seed-version /prefetch:8
1⤵
PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4740 -ip 4740
1⤵
PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4740 -ip 4740
1⤵
PID:1552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4740 -ip 4740
1⤵
PID:4008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ab344f1d6e8ca05a1354921d152d9386b3d0b8d1417174d75260d706378a3631.exe

Filesize
448KB

MD5
6fab92fec82108aa7f7dd8769973f50c

SHA1
f7cac90b1f5335db7d6abbfe99e0391cb9b03c59

SHA256
90200ed722771c730f103ea7f5caf2348b9db0d5597f617d67f98a4aab13e818

SHA512
1ea3f628ae3a705e5d880f58e6a6ea2201ca9236eb22ea49bab01ba696897fc8206207dd0a23020ffcac53cea8a98938a6757492195820be11965373897aa52e

Download Submit
memory/1000-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1000-6-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4740-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4740-8-0x00000000014C0000-0x00000000014FC000-memory.dmp

Filesize
240KB

Download
memory/4740-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download