4bc0c6bbea024b48d3428ebbf8d2fabe644c246e1a2453d8c0f48512ff4b3e05

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 19:56

Target

4bc0c6bbea024b48d3428ebbf8d2fabe644c246e1a2453d8c0f48512ff4b3e05.exe
Size

1.1MB
MD5

b93479f08d381d5e2e88a14163b7e1d2
SHA1

e53978f28c27eb4f4a1383445d992070ab4aee6c
SHA256

4bc0c6bbea024b48d3428ebbf8d2fabe644c246e1a2453d8c0f48512ff4b3e05
SHA512

4a41c417747223d60a3d1a21d30ef49e31ff797ecf98ed24b4ea4860ca118758745f1989b50d442aea5b1239274da46a957cfd5fb8fe259919273a87f6887ec0
SSDEEP

12288:0thlUijvH9IVyDgaLjjVDa/ZS4fD7HnhvMCtjW:0thlUamEDzLRa/ZS4fDDueC

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2152	4bc0c6bbea024b48d3428ebbf8d2fabe644c246e1a2453d8c0f48512ff4b3e05.exe

Loads dropped DLL 4 IoCs

pid	Process
1640	4bc0c6bbea024b48d3428ebbf8d2fabe644c246e1a2453d8c0f48512ff4b3e05.exe
2820	WerFault.exe
2820	WerFault.exe
2820	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2820	2152	WerFault.exe	29

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1640	4bc0c6bbea024b48d3428ebbf8d2fabe644c246e1a2453d8c0f48512ff4b3e05.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2152	4bc0c6bbea024b48d3428ebbf8d2fabe644c246e1a2453d8c0f48512ff4b3e05.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2152	1640	4bc0c6bbea024b48d3428ebbf8d2fabe644c246e1a2453d8c0f48512ff4b3e05.exe	29
PID 1640 wrote to memory of 2152	1640	4bc0c6bbea024b48d3428ebbf8d2fabe644c246e1a2453d8c0f48512ff4b3e05.exe	29
PID 1640 wrote to memory of 2152	1640	4bc0c6bbea024b48d3428ebbf8d2fabe644c246e1a2453d8c0f48512ff4b3e05.exe	29
PID 1640 wrote to memory of 2152	1640	4bc0c6bbea024b48d3428ebbf8d2fabe644c246e1a2453d8c0f48512ff4b3e05.exe	29
PID 2152 wrote to memory of 2820	2152	4bc0c6bbea024b48d3428ebbf8d2fabe644c246e1a2453d8c0f48512ff4b3e05.exe	30
PID 2152 wrote to memory of 2820	2152	4bc0c6bbea024b48d3428ebbf8d2fabe644c246e1a2453d8c0f48512ff4b3e05.exe	30
PID 2152 wrote to memory of 2820	2152	4bc0c6bbea024b48d3428ebbf8d2fabe644c246e1a2453d8c0f48512ff4b3e05.exe	30
PID 2152 wrote to memory of 2820	2152	4bc0c6bbea024b48d3428ebbf8d2fabe644c246e1a2453d8c0f48512ff4b3e05.exe	30

\Users\Admin\AppData\Local\Temp\4bc0c6bbea024b48d3428ebbf8d2fabe644c246e1a2453d8c0f48512ff4b3e05.exe

Filesize
1.1MB

MD5
6a1db2fa976f051bafc2eb7279eb21e5

SHA1
0a3d25699949849d785f7f78c60faf19f5ef8d96

SHA256
6f358b04c6d8e76efafc6626c54089432997d67955d8a041f71aadc125d66c9d

SHA512
c9f351d6de7c5077d857f5ce8a8494d1eec1255e1d3a151b1debdaef2a06214517f534c4ee45cb0164204896b7a15aa0ac2daf7984f47cd01c1d5bca679c2fc9

Download Submit
memory/1640-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/1640-6-0x00000000030F0000-0x00000000031DF000-memory.dmp

Filesize
956KB

Download
memory/1640-8-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2152-10-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2152-11-0x00000000014F0000-0x00000000015DF000-memory.dmp

Filesize
956KB

Download
memory/2152-15-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download