3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe
Size

217KB
MD5

f0b5654ec744e3a1a2439887a3216704
SHA1

4ad99a68e2f40487da7d1c156cc8aa7fa7096bfc
SHA256

3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c
SHA512

580dd17664ee36fb0640a4a70e46ae8881026183cb044277632c0b70f617254833cd17f2dfcdb03a08a9de608319c8e8c0a752498c2ae902ec8d8adac6a6a9e8
SSDEEP

3072:n8cj6C4KCYcqJTyLPwSLTfhrGRi/X78zgD6D8pmrfVg7gRXLboitn/o:8cp46cqJTy7N4i/Ek68KDRXAit/o

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4268	3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe

Executes dropped EXE 1 IoCs

pid	Process
4268	3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
3024	2612	WerFault.exe	87
3900	4268	WerFault.exe	95
2040	4268	WerFault.exe	95
2292	4268	WerFault.exe	95
3120	4268	WerFault.exe	95
1284	4268	WerFault.exe	95
2308	4268	WerFault.exe	95

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2612	3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4268	3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 4268	2612	3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe	95
PID 2612 wrote to memory of 4268	2612	3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe	95
PID 2612 wrote to memory of 4268	2612	3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe	95

C:\Users\Admin\AppData\Local\Temp\3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe
"C:\Users\Admin\AppData\Local\Temp\3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 384
  2⤵
  - Program crash
  PID:3024
- C:\Users\Admin\AppData\Local\Temp\3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe
  C:\Users\Admin\AppData\Local\Temp\3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 352
    3⤵
    - Program crash
    PID:3900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 772
    3⤵
    - Program crash
    PID:2040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 808
    3⤵
    - Program crash
    PID:2292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 780
    3⤵
    - Program crash
    PID:3120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 776
    3⤵
    - Program crash
    PID:1284
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 800
    3⤵
    - Program crash
    PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2612 -ip 2612
1⤵
PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4268 -ip 4268
1⤵
PID:1880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4268 -ip 4268
1⤵
PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4268 -ip 4268
1⤵
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4268 -ip 4268
1⤵
PID:2172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4268 -ip 4268
1⤵
PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4268 -ip 4268
1⤵
PID:3664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe

Filesize
217KB

MD5
eeb0cf0463f8f69f169b3f133ba87e5c

SHA1
e11a891212dcb74dc6925479d9307e162ab09a9b

SHA256
d2e6d99904b34d76b087636913ab87855db1b79cd42f913f0c47058566023994

SHA512
d80a55a5ad082654a476819c2739784dae2a804b34367f5cf57cb4065d74e82e04aa785fef5395342cf842de27d5522ca9d587981f58856bb8fe85963ebb0830

Download Submit
memory/2612-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2612-6-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4268-7-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4268-8-0x00000000001A0000-0x00000000001DB000-memory.dmp

Filesize
236KB

Download
memory/4268-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download