b46b477516b5d8ffbd81663d3ffd8b6bf5db6b03bbf16d56f3bdc57eb7af9cbe

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 09:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b46b477516b5d8ffbd81663d3ffd8b6bf5db6b03bbf16d56f3bdc57eb7af9cbe.exe
Size

190KB
MD5

d5ec6a19366826da29f0f1adf2f92a22
SHA1

ba64824ef36079a4344e065f8c27b80ab5afc9bf
SHA256

b46b477516b5d8ffbd81663d3ffd8b6bf5db6b03bbf16d56f3bdc57eb7af9cbe
SHA512

13b8b2e0236725e98fd672f1802ed0e098fb52aa340d1984b95126199d847a6961d8fe7e1da05abd888fcd7902dff33103cd9d768e7c038629efb69494862a07
SSDEEP

3072:8DqhDzP9P/4qghV0SlOK10xnSQg6OLQ0cOfjaSsIAKMYIw9VTGIff2LLexnUW9qL:8+hDZ/Hgb04/yxSQh+fjTAKM3w9V5f8P

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3872	b46b477516b5d8ffbd81663d3ffd8b6bf5db6b03bbf16d56f3bdc57eb7af9cbe.exe

Executes dropped EXE 1 IoCs

pid	Process
3872	b46b477516b5d8ffbd81663d3ffd8b6bf5db6b03bbf16d56f3bdc57eb7af9cbe.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
1036	320	WerFault.exe	91
3572	3872	WerFault.exe	99
4412	3872	WerFault.exe	99
4688	3872	WerFault.exe	99
3236	3872	WerFault.exe	99
2052	3872	WerFault.exe	99
2904	3872	WerFault.exe	99

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
320	b46b477516b5d8ffbd81663d3ffd8b6bf5db6b03bbf16d56f3bdc57eb7af9cbe.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3872	b46b477516b5d8ffbd81663d3ffd8b6bf5db6b03bbf16d56f3bdc57eb7af9cbe.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 3872	320	b46b477516b5d8ffbd81663d3ffd8b6bf5db6b03bbf16d56f3bdc57eb7af9cbe.exe	99
PID 320 wrote to memory of 3872	320	b46b477516b5d8ffbd81663d3ffd8b6bf5db6b03bbf16d56f3bdc57eb7af9cbe.exe	99
PID 320 wrote to memory of 3872	320	b46b477516b5d8ffbd81663d3ffd8b6bf5db6b03bbf16d56f3bdc57eb7af9cbe.exe	99

C:\Users\Admin\AppData\Local\Temp\b46b477516b5d8ffbd81663d3ffd8b6bf5db6b03bbf16d56f3bdc57eb7af9cbe.exe
"C:\Users\Admin\AppData\Local\Temp\b46b477516b5d8ffbd81663d3ffd8b6bf5db6b03bbf16d56f3bdc57eb7af9cbe.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 384
  2⤵
  - Program crash
  PID:1036
- C:\Users\Admin\AppData\Local\Temp\b46b477516b5d8ffbd81663d3ffd8b6bf5db6b03bbf16d56f3bdc57eb7af9cbe.exe
  C:\Users\Admin\AppData\Local\Temp\b46b477516b5d8ffbd81663d3ffd8b6bf5db6b03bbf16d56f3bdc57eb7af9cbe.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 352
    3⤵
    - Program crash
    PID:3572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 768
    3⤵
    - Program crash
    PID:4412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 772
    3⤵
    - Program crash
    PID:4688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 824
    3⤵
    - Program crash
    PID:3236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 776
    3⤵
    - Program crash
    PID:2052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 832
    3⤵
    - Program crash
    PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 320 -ip 320
1⤵
PID:232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3872 -ip 3872
1⤵
PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3872 -ip 3872
1⤵
PID:2344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3872 -ip 3872
1⤵
PID:1772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2284,i,2771196087253062161,8107167670425198948,262144 --variations-seed-version /prefetch:8
1⤵
PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3872 -ip 3872
1⤵
PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3872 -ip 3872
1⤵
PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3872 -ip 3872
1⤵
PID:1904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b46b477516b5d8ffbd81663d3ffd8b6bf5db6b03bbf16d56f3bdc57eb7af9cbe.exe

Filesize
190KB

MD5
d1eb9779271c9c3f9eb488d6ee540e8f

SHA1
7792d5b746c4cededa41613954bd616cfb066775

SHA256
d2beafce93f063f48b243e38d57bd5742bdfb8a408d0e7b4710e680cc00ff36a

SHA512
486c518bee6ff44175c8cce9f4fb074735067cdcb539126c4cded014b09c5d4859b9ef0e6bcae5a19cc1cd91b6f37e29bcf4a8ce75cd41c1bf4796001bb4bc45

Download Submit
memory/320-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/320-6-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3872-7-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3872-8-0x0000000001660000-0x000000000169A000-memory.dmp

Filesize
232KB

Download
memory/3872-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3872-14-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download