fd80ce8d4acc3d4e201c8fc7811d9a7d73a3241972259261d2d02de5751ee031

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 11:08

Target

fd80ce8d4acc3d4e201c8fc7811d9a7d73a3241972259261d2d02de5751ee031.exe
Size

479KB
MD5

a1d04cd8ae36c87093e9a0b4347543e5
SHA1

00f1b12650e87c99434d3423d71b2d20f81a56e5
SHA256

fd80ce8d4acc3d4e201c8fc7811d9a7d73a3241972259261d2d02de5751ee031
SHA512

da58a0476c3215b5cb917721906f33ee1ec45e3cd7fff8286e9c147e4a2eeba681853ba8997dce243afadfacd6558d7c6680f70a2bfb47d673f6b12ac865bd74
SSDEEP

12288:s6Ts16VT5rs/3VtdW/sEzrWtHOw0iFauY/B/dEc0i3rALrbEcgYwuGggfcj:s76VTQVtdW/sEzrWtHOw0iFauY/B/dEx

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1756	fd80ce8d4acc3d4e201c8fc7811d9a7d73a3241972259261d2d02de5751ee031.exe

Executes dropped EXE 1 IoCs

pid	Process
1756	fd80ce8d4acc3d4e201c8fc7811d9a7d73a3241972259261d2d02de5751ee031.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2548	4400	WerFault.exe	89
4932	1756	WerFault.exe	98

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4400	fd80ce8d4acc3d4e201c8fc7811d9a7d73a3241972259261d2d02de5751ee031.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1756	fd80ce8d4acc3d4e201c8fc7811d9a7d73a3241972259261d2d02de5751ee031.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 1756	4400	fd80ce8d4acc3d4e201c8fc7811d9a7d73a3241972259261d2d02de5751ee031.exe	98
PID 4400 wrote to memory of 1756	4400	fd80ce8d4acc3d4e201c8fc7811d9a7d73a3241972259261d2d02de5751ee031.exe	98
PID 4400 wrote to memory of 1756	4400	fd80ce8d4acc3d4e201c8fc7811d9a7d73a3241972259261d2d02de5751ee031.exe	98

C:\Users\Admin\AppData\Local\Temp\fd80ce8d4acc3d4e201c8fc7811d9a7d73a3241972259261d2d02de5751ee031.exe
"C:\Users\Admin\AppData\Local\Temp\fd80ce8d4acc3d4e201c8fc7811d9a7d73a3241972259261d2d02de5751ee031.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 396
  2⤵
  - Program crash
  PID:2548
- C:\Users\Admin\AppData\Local\Temp\fd80ce8d4acc3d4e201c8fc7811d9a7d73a3241972259261d2d02de5751ee031.exe
  C:\Users\Admin\AppData\Local\Temp\fd80ce8d4acc3d4e201c8fc7811d9a7d73a3241972259261d2d02de5751ee031.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 364
    3⤵
    - Program crash
    PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4400 -ip 4400
1⤵
PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1756 -ip 1756
1⤵
PID:4596

C:\Users\Admin\AppData\Local\Temp\fd80ce8d4acc3d4e201c8fc7811d9a7d73a3241972259261d2d02de5751ee031.exe

Filesize
479KB

MD5
e7fcb6e615753edcb55d07ce6e517ca1

SHA1
daf59a3daa61cd47050cf623e255c22300fdff7f

SHA256
0aca1edd3ab48cafd63ca63ff1d3dfd3a4d3734aa74af2bd3be20ea9bb663054

SHA512
84f4ee0158a34f5e6986ad3b08776d52a57245c0c62efec044c7138c560ab054c61ae487a6926001a90f78e7fdc0d2a63ccdcde5a61a694c73f4c0462fd1e36d

Download Submit
memory/1756-7-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1756-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1756-10-0x00000000014A0000-0x00000000014D7000-memory.dmp

Filesize
220KB

Download
memory/4400-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4400-6-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download