2a745a246fccad8b02934c9398cb7a8972c8929ceaecdba492f9461f75b16ee3

Analysis

max time kernel
149s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a745a246fccad8b02934c9398cb7a8972c8929ceaecdba492f9461f75b16ee3.exe
Size

528KB
MD5

f1530228f233fe762b163adca61d5694
SHA1

23482057fe5a918afa1507442177fdfa5407f9fb
SHA256

2a745a246fccad8b02934c9398cb7a8972c8929ceaecdba492f9461f75b16ee3
SHA512

dd4f1f4558b265c58f50d51e873877956d9a4dd8f5012c33e5d3934319942749c774aaa90a5f0134090739eb2474c37faca17740956ae53ad8232e424ef94615
SSDEEP

12288:xa6tNuaskuO50npM4dl0v5JHpS0wULVnMhysFje:xRtYA5EM4dmv5Xf+hS

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4892	2a745a246fccad8b02934c9398cb7a8972c8929ceaecdba492f9461f75b16ee3.exe

Executes dropped EXE 1 IoCs

pid	Process
4892	2a745a246fccad8b02934c9398cb7a8972c8929ceaecdba492f9461f75b16ee3.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
1664	4068	WerFault.exe	85
4564	4892	WerFault.exe	91
4688	4892	WerFault.exe	91
4388	4892	WerFault.exe	91
1560	4892	WerFault.exe	91
5036	4892	WerFault.exe	91
1028	4892	WerFault.exe	91

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4068	2a745a246fccad8b02934c9398cb7a8972c8929ceaecdba492f9461f75b16ee3.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4892	2a745a246fccad8b02934c9398cb7a8972c8929ceaecdba492f9461f75b16ee3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 4892	4068	2a745a246fccad8b02934c9398cb7a8972c8929ceaecdba492f9461f75b16ee3.exe	91
PID 4068 wrote to memory of 4892	4068	2a745a246fccad8b02934c9398cb7a8972c8929ceaecdba492f9461f75b16ee3.exe	91
PID 4068 wrote to memory of 4892	4068	2a745a246fccad8b02934c9398cb7a8972c8929ceaecdba492f9461f75b16ee3.exe	91

C:\Users\Admin\AppData\Local\Temp\2a745a246fccad8b02934c9398cb7a8972c8929ceaecdba492f9461f75b16ee3.exe
"C:\Users\Admin\AppData\Local\Temp\2a745a246fccad8b02934c9398cb7a8972c8929ceaecdba492f9461f75b16ee3.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 388
  2⤵
  - Program crash
  PID:1664
- C:\Users\Admin\AppData\Local\Temp\2a745a246fccad8b02934c9398cb7a8972c8929ceaecdba492f9461f75b16ee3.exe
  C:\Users\Admin\AppData\Local\Temp\2a745a246fccad8b02934c9398cb7a8972c8929ceaecdba492f9461f75b16ee3.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 352
    3⤵
    - Program crash
    PID:4564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 768
    3⤵
    - Program crash
    PID:4688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 788
    3⤵
    - Program crash
    PID:4388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 796
    3⤵
    - Program crash
    PID:1560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 776
    3⤵
    - Program crash
    PID:5036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 796
    3⤵
    - Program crash
    PID:1028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4068 -ip 4068
1⤵
PID:924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4892 -ip 4892
1⤵
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4892 -ip 4892
1⤵
PID:4768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4892 -ip 4892
1⤵
PID:948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4892 -ip 4892
1⤵
PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4892 -ip 4892
1⤵
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4892 -ip 4892
1⤵
PID:2936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2a745a246fccad8b02934c9398cb7a8972c8929ceaecdba492f9461f75b16ee3.exe

Filesize
528KB

MD5
3a6d8423fad91f81116708ceaa85c29b

SHA1
e94b9f1098a4896909533eeaf9af4630adcdfc6d

SHA256
5829a22a6d0fb9c0812f985200823cdb6799142f413a73cb00eb4d88e19494f2

SHA512
46a6dc5bd5b9d6558b1bcd69097283def43b92609f1caa94c048b195182d299b36fc8db0d104a97ab7ef4f142bba059d7869f17f5bf696137b58ad6d069c6124

Download Submit
memory/4068-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4068-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4892-6-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4892-8-0x0000000001490000-0x00000000014CC000-memory.dmp

Filesize
240KB

Download
memory/4892-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download