eb6251e6d423d3f46d35c4082a0835fdce4640cc3634707fd081d90803527edf

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20-03-2024 01:49

Target

eb6251e6d423d3f46d35c4082a0835fdce4640cc3634707fd081d90803527edf.exe
Size

193KB
MD5

46dc1eb26c37c0d8dbf89e1c0bd677cf
SHA1

5adbc469c7af45cad35961502da0f538d330c15d
SHA256

eb6251e6d423d3f46d35c4082a0835fdce4640cc3634707fd081d90803527edf
SHA512

923e80054ba5bed36b76ce407995b8128e1a0c23512429cfe13f31137a143815000a57012cd4f5d1475aafff2f71f6361648b558e49b036034270d1b3417cdac
SSDEEP

3072:pTqf51/D6JFBy5En97xKDUKg2eXPyxVXQqu1NvWlKfWW/eN:pTqxBeJOM7wQrVKoqu1pVfWWK

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3356	eb6251e6d423d3f46d35c4082a0835fdce4640cc3634707fd081d90803527edf.exe

Executes dropped EXE 1 IoCs

pid	Process
3356	eb6251e6d423d3f46d35c4082a0835fdce4640cc3634707fd081d90803527edf.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2288	4968	WerFault.exe	94
2372	3356	WerFault.exe	102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4968	eb6251e6d423d3f46d35c4082a0835fdce4640cc3634707fd081d90803527edf.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3356	eb6251e6d423d3f46d35c4082a0835fdce4640cc3634707fd081d90803527edf.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 3356	4968	eb6251e6d423d3f46d35c4082a0835fdce4640cc3634707fd081d90803527edf.exe	102
PID 4968 wrote to memory of 3356	4968	eb6251e6d423d3f46d35c4082a0835fdce4640cc3634707fd081d90803527edf.exe	102
PID 4968 wrote to memory of 3356	4968	eb6251e6d423d3f46d35c4082a0835fdce4640cc3634707fd081d90803527edf.exe	102

C:\Users\Admin\AppData\Local\Temp\eb6251e6d423d3f46d35c4082a0835fdce4640cc3634707fd081d90803527edf.exe
"C:\Users\Admin\AppData\Local\Temp\eb6251e6d423d3f46d35c4082a0835fdce4640cc3634707fd081d90803527edf.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 396
  2⤵
  - Program crash
  PID:2288
- C:\Users\Admin\AppData\Local\Temp\eb6251e6d423d3f46d35c4082a0835fdce4640cc3634707fd081d90803527edf.exe
  C:\Users\Admin\AppData\Local\Temp\eb6251e6d423d3f46d35c4082a0835fdce4640cc3634707fd081d90803527edf.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 364
    3⤵
    - Program crash
    PID:2372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4968 -ip 4968
1⤵
PID:2688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3356 -ip 3356
1⤵
PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4280 --field-trial-handle=3488,i,1267426273081718772,6254127258555406296,262144 --variations-seed-version /prefetch:8
1⤵
PID:4116

C:\Users\Admin\AppData\Local\Temp\eb6251e6d423d3f46d35c4082a0835fdce4640cc3634707fd081d90803527edf.exe

Filesize
193KB

MD5
a2b9a9fc7e3d96fab3711bcf95fd664a

SHA1
8f9ac774d2cbf44fa024df72f052af355fdeae42

SHA256
ed0c506312e418459d9542c1a0e727feb42b308b1d1478a25d3a8e92ab02b1f4

SHA512
0c8d867819558585ca021a370e9c53604678914c0e0ad197985f99a608f94e22d3e2590cabca91c1919b9739571f3b7e9d6348ae150e5f0fdf7ab1c0ac12f3d9

Download Submit
memory/3356-7-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3356-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3356-11-0x00000000014C0000-0x00000000014F8000-memory.dmp

Filesize
224KB

Download
memory/4968-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4968-6-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download