db6cb5a09417cca5f4f3e48c5d231332161f28527c6dd9e0d651823516eb1e58

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 00:36

Target

db6cb5a09417cca5f4f3e48c5d231332161f28527c6dd9e0d651823516eb1e58.exe
Size

711KB
MD5

0f2b26125e65c2f9317c7030e230be67
SHA1

29a7d73d0068e4fb97fbef2daba490c7586cddfc
SHA256

db6cb5a09417cca5f4f3e48c5d231332161f28527c6dd9e0d651823516eb1e58
SHA512

26da616845c1162cbd57a595182f0898639b4d0e5525cf0f12bc89be4543e2e307e194fcbf0e4861661ee4126d50d3c2774cbed10581083c3d4351638b7a4881
SSDEEP

12288:r9wq8qwMnfnNt/8IOMIP8mcenRv27NSJBpNeAsLIVe91W1BUAn1Mo75VLShLCMkl:t8mfI0umrIVe9YymVLShLCMkKvDYw5FK

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1776	db6cb5a09417cca5f4f3e48c5d231332161f28527c6dd9e0d651823516eb1e58.exe

Executes dropped EXE 1 IoCs

pid	Process
1776	db6cb5a09417cca5f4f3e48c5d231332161f28527c6dd9e0d651823516eb1e58.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
428	2188	WerFault.exe	84
740	1776	WerFault.exe	92

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2188	db6cb5a09417cca5f4f3e48c5d231332161f28527c6dd9e0d651823516eb1e58.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1776	db6cb5a09417cca5f4f3e48c5d231332161f28527c6dd9e0d651823516eb1e58.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1776	2188	db6cb5a09417cca5f4f3e48c5d231332161f28527c6dd9e0d651823516eb1e58.exe	92
PID 2188 wrote to memory of 1776	2188	db6cb5a09417cca5f4f3e48c5d231332161f28527c6dd9e0d651823516eb1e58.exe	92
PID 2188 wrote to memory of 1776	2188	db6cb5a09417cca5f4f3e48c5d231332161f28527c6dd9e0d651823516eb1e58.exe	92

C:\Users\Admin\AppData\Local\Temp\db6cb5a09417cca5f4f3e48c5d231332161f28527c6dd9e0d651823516eb1e58.exe
"C:\Users\Admin\AppData\Local\Temp\db6cb5a09417cca5f4f3e48c5d231332161f28527c6dd9e0d651823516eb1e58.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 396
  2⤵
  - Program crash
  PID:428
- C:\Users\Admin\AppData\Local\Temp\db6cb5a09417cca5f4f3e48c5d231332161f28527c6dd9e0d651823516eb1e58.exe
  C:\Users\Admin\AppData\Local\Temp\db6cb5a09417cca5f4f3e48c5d231332161f28527c6dd9e0d651823516eb1e58.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 364
    3⤵
    - Program crash
    PID:740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2188 -ip 2188
1⤵
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1776 -ip 1776
1⤵
PID:4740

C:\Users\Admin\AppData\Local\Temp\db6cb5a09417cca5f4f3e48c5d231332161f28527c6dd9e0d651823516eb1e58.exe

Filesize
711KB

MD5
51c28242567efc22b6bcfc5c004c3da1

SHA1
9916f9678de4b8a64c67f032a94522c67cc18cc1

SHA256
461bad8bde9bff2480f05957d3e77cdefe02f14084f2818039029b13a60c3856

SHA512
d9fdb2768a02fd2af868a666adcfee59d893eaa0a6ef36ce647e1dc631d03f546231009becdfe7447d2e686a666bef8cb86a367a4bef4c73f1300cdcfc3d4e42

Download Submit
memory/1776-6-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1776-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1776-13-0x00000000014F0000-0x0000000001528000-memory.dmp

Filesize
224KB

Download
memory/2188-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2188-7-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download