cb7d4b84dce2127692e605e23618eec5cfc2fb26d57ff338b3dec273f9f1db47

Analysis

max time kernel
92s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2024 21:20

Target

cb7d4b84dce2127692e605e23618eec5cfc2fb26d57ff338b3dec273f9f1db47.exe
Size

218KB
MD5

f56ceecc3aaa647e80fecbd42c78d210
SHA1

a68bc41db77770e7b85c96e0ba55755c0e0c00d6
SHA256

cb7d4b84dce2127692e605e23618eec5cfc2fb26d57ff338b3dec273f9f1db47
SHA512

86f29501f33b0c632ec9115df17bc6c28e2dad6145d4c8f0375fefd92ed12e3b9f1e2f60af4d3165a537baeaee6410914600b307ac67ef74560f95cf82fef6b7
SSDEEP

3072:u45gkcYusEcTpeJjuDGNTmqC97EJ3YB19HU3AuuZTwar3xKWdwqbRpmiaoG9Qxs3:H32cNekCEqhXsr3FwqbX9aLisM+Nea

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4500	cb7d4b84dce2127692e605e23618eec5cfc2fb26d57ff338b3dec273f9f1db47.exe

Executes dropped EXE 1 IoCs

pid	Process
4500	cb7d4b84dce2127692e605e23618eec5cfc2fb26d57ff338b3dec273f9f1db47.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2852	4236	WerFault.exe	84
4736	4500	WerFault.exe	89

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4236	cb7d4b84dce2127692e605e23618eec5cfc2fb26d57ff338b3dec273f9f1db47.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4500	cb7d4b84dce2127692e605e23618eec5cfc2fb26d57ff338b3dec273f9f1db47.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 4500	4236	cb7d4b84dce2127692e605e23618eec5cfc2fb26d57ff338b3dec273f9f1db47.exe	89
PID 4236 wrote to memory of 4500	4236	cb7d4b84dce2127692e605e23618eec5cfc2fb26d57ff338b3dec273f9f1db47.exe	89
PID 4236 wrote to memory of 4500	4236	cb7d4b84dce2127692e605e23618eec5cfc2fb26d57ff338b3dec273f9f1db47.exe	89

C:\Users\Admin\AppData\Local\Temp\cb7d4b84dce2127692e605e23618eec5cfc2fb26d57ff338b3dec273f9f1db47.exe
"C:\Users\Admin\AppData\Local\Temp\cb7d4b84dce2127692e605e23618eec5cfc2fb26d57ff338b3dec273f9f1db47.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 396
  2⤵
  - Program crash
  PID:2852
- C:\Users\Admin\AppData\Local\Temp\cb7d4b84dce2127692e605e23618eec5cfc2fb26d57ff338b3dec273f9f1db47.exe
  C:\Users\Admin\AppData\Local\Temp\cb7d4b84dce2127692e605e23618eec5cfc2fb26d57ff338b3dec273f9f1db47.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 372
    3⤵
    - Program crash
    PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4236 -ip 4236
1⤵
PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4500 -ip 4500
1⤵
PID:3068

C:\Users\Admin\AppData\Local\Temp\cb7d4b84dce2127692e605e23618eec5cfc2fb26d57ff338b3dec273f9f1db47.exe

Filesize
218KB

MD5
dcf3230fe7213fe530e7cb151de76884

SHA1
16c267686c738b760015c69f59bb9832b5f9cec7

SHA256
5ad433eb96c4e0a6d14c6959a5cd11b4d905833f58c2256b78a86cc4738608ad

SHA512
31e4416803210826cabacda5f7828ada393fdda3faebe25ae4d1dabc79a7747ad2f17e0ab3942a4e183a028272a5a87fe70646f0584f202dcdb6569e3fdf233b

Download Submit
memory/4236-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4236-6-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4500-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4500-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4500-13-0x00000000014C0000-0x0000000001502000-memory.dmp

Filesize
264KB

Download