64e900f7111fa308b732015687e227a5e8f80e1cf6ae709567bdafa84803c2be

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 22:16

Target

64e900f7111fa308b732015687e227a5e8f80e1cf6ae709567bdafa84803c2be.exe
Size

256KB
MD5

a30743d28a2e3c05df407f3a1b35bff5
SHA1

795d14c22d9938e0b502e732bdd9b2fbbdc81c8e
SHA256

64e900f7111fa308b732015687e227a5e8f80e1cf6ae709567bdafa84803c2be
SHA512

d0592ad2aa33e0b571c1636d0f610fd32332cc66a8c8fca3c4872a50187230657f95956ebb89e83ede7bfbd085a3c37f2eea429ff105f1d797d9b5d8565e2017
SSDEEP

6144:T7K+Iu4cQIyED+RNdjP+v0W7cyqCxSngmMBqf7:1ItcQIyu+R7y50npM47

Score

7^/10

Deletes itself 1 IoCs

pid	Process
568	64e900f7111fa308b732015687e227a5e8f80e1cf6ae709567bdafa84803c2be.exe

Executes dropped EXE 1 IoCs

pid	Process
568	64e900f7111fa308b732015687e227a5e8f80e1cf6ae709567bdafa84803c2be.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
488	4504	WerFault.exe	83
2700	568	WerFault.exe	90
3252	568	WerFault.exe	90
5012	568	WerFault.exe	90
1984	568	WerFault.exe	90

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4504	64e900f7111fa308b732015687e227a5e8f80e1cf6ae709567bdafa84803c2be.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
568	64e900f7111fa308b732015687e227a5e8f80e1cf6ae709567bdafa84803c2be.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 568	4504	64e900f7111fa308b732015687e227a5e8f80e1cf6ae709567bdafa84803c2be.exe	90
PID 4504 wrote to memory of 568	4504	64e900f7111fa308b732015687e227a5e8f80e1cf6ae709567bdafa84803c2be.exe	90
PID 4504 wrote to memory of 568	4504	64e900f7111fa308b732015687e227a5e8f80e1cf6ae709567bdafa84803c2be.exe	90

C:\Users\Admin\AppData\Local\Temp\64e900f7111fa308b732015687e227a5e8f80e1cf6ae709567bdafa84803c2be.exe
"C:\Users\Admin\AppData\Local\Temp\64e900f7111fa308b732015687e227a5e8f80e1cf6ae709567bdafa84803c2be.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 392
  2⤵
  - Program crash
  PID:488
- C:\Users\Admin\AppData\Local\Temp\64e900f7111fa308b732015687e227a5e8f80e1cf6ae709567bdafa84803c2be.exe
  C:\Users\Admin\AppData\Local\Temp\64e900f7111fa308b732015687e227a5e8f80e1cf6ae709567bdafa84803c2be.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 568 -s 360
    3⤵
    - Program crash
    PID:2700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 568 -s 768
    3⤵
    - Program crash
    PID:3252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 568 -s 788
    3⤵
    - Program crash
    PID:5012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 568 -s 772
    3⤵
    - Program crash
    PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4504 -ip 4504
1⤵
PID:2592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 568 -ip 568
1⤵
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 568 -ip 568
1⤵
PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 568 -ip 568
1⤵
PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 568 -ip 568
1⤵
PID:4504

C:\Users\Admin\AppData\Local\Temp\64e900f7111fa308b732015687e227a5e8f80e1cf6ae709567bdafa84803c2be.exe

Filesize
256KB

MD5
163756eeaace10643a6acccd449b0918

SHA1
a31068649afadd82868e54c7e864d74e57c6237c

SHA256
ccd435aa7a73f2306cbf63f7c49eec5a20e4ea06a3118a8e4552370382c5349b

SHA512
a743932630a93a05d58cbd5fa15c79f6cedb207f5668b8cec1481fdbbdbfa36188fcf9a8e8c3f57d20f2ae49f15cae8871c5afc55bbb5fa382efe3bf1f9b80da

Download Submit
memory/568-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/568-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/568-8-0x0000000001510000-0x000000000154C000-memory.dmp

Filesize
240KB

Download
memory/4504-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4504-6-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download