ed01297224f438ede9652b1777970917f6e21950b2da3e0cc3a05330433d83d0

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 01:53

Target

ed01297224f438ede9652b1777970917f6e21950b2da3e0cc3a05330433d83d0.exe
Size

194KB
MD5

32d98c3da9a2be71c1e2e5b63235e8d3
SHA1

fd4a82c384d9f297ab7233c5cb48854ff65d90c6
SHA256

ed01297224f438ede9652b1777970917f6e21950b2da3e0cc3a05330433d83d0
SHA512

fdd0451c630958bf350f68c5c4b4f59ea1d01ccd77e954a962c7f4cc62aa76239bc4b32ea0f5e34bfddf51ef5461239556f6c59438772012d2b197bba5603251
SSDEEP

3072:VF6LjAO8qoLxZ8HQLFC7IBqP2mgkVwgLTUHy:aAO8LTvBqLLWi

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2324	ed01297224f438ede9652b1777970917f6e21950b2da3e0cc3a05330433d83d0.exe

Executes dropped EXE 1 IoCs

pid	Process
2324	ed01297224f438ede9652b1777970917f6e21950b2da3e0cc3a05330433d83d0.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4148	2244	WerFault.exe	87
4012	2324	WerFault.exe	95

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2244	ed01297224f438ede9652b1777970917f6e21950b2da3e0cc3a05330433d83d0.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2324	ed01297224f438ede9652b1777970917f6e21950b2da3e0cc3a05330433d83d0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2324	2244	ed01297224f438ede9652b1777970917f6e21950b2da3e0cc3a05330433d83d0.exe	95
PID 2244 wrote to memory of 2324	2244	ed01297224f438ede9652b1777970917f6e21950b2da3e0cc3a05330433d83d0.exe	95
PID 2244 wrote to memory of 2324	2244	ed01297224f438ede9652b1777970917f6e21950b2da3e0cc3a05330433d83d0.exe	95

C:\Users\Admin\AppData\Local\Temp\ed01297224f438ede9652b1777970917f6e21950b2da3e0cc3a05330433d83d0.exe
"C:\Users\Admin\AppData\Local\Temp\ed01297224f438ede9652b1777970917f6e21950b2da3e0cc3a05330433d83d0.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 424
  2⤵
  - Program crash
  PID:4148
- C:\Users\Admin\AppData\Local\Temp\ed01297224f438ede9652b1777970917f6e21950b2da3e0cc3a05330433d83d0.exe
  C:\Users\Admin\AppData\Local\Temp\ed01297224f438ede9652b1777970917f6e21950b2da3e0cc3a05330433d83d0.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 408
    3⤵
    - Program crash
    PID:4012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2244 -ip 2244
1⤵
PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2324 -ip 2324
1⤵
PID:4820

C:\Users\Admin\AppData\Local\Temp\ed01297224f438ede9652b1777970917f6e21950b2da3e0cc3a05330433d83d0.exe

Filesize
194KB

MD5
b3aade3dcb30f22838155fe346f1b4b2

SHA1
8d275da41e208a49c21d44484f4e5698a6bbdb1b

SHA256
5154a547b74679c50099f59289cd4af33e63e1b309344a824f9dd48651d8fad4

SHA512
0dad788b6ad94fc2df4a51e9b6beb287bb69ca4a9898efdf6f759a90f8a4a98a6b395aad2c4de8cfe48c6039a01d8b0ef43e5aac19d08b91245ea9c504be4799

Download Submit
memory/2244-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2244-6-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2324-7-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2324-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2324-13-0x0000000003D60000-0x0000000003D99000-memory.dmp

Filesize
228KB

Download