8077cccc46c5c8f48721da6e8dba50a54c776684ad1d9929367ddc1cfd143557

Analysis

max time kernel
145s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8077cccc46c5c8f48721da6e8dba50a54c776684ad1d9929367ddc1cfd143557.exe
Size

256KB
MD5

5f061c8ad6e7a6b03d91ec1fa864679a
SHA1

b7ae1f791a85461eed72a39d8dbf4c0cda0968b7
SHA256

8077cccc46c5c8f48721da6e8dba50a54c776684ad1d9929367ddc1cfd143557
SHA512

36d286eaab3c4925e809d05b99e5031243b1a302436c1df5df5ca1a094e9857730e0acd0b6eac03e6453a36c318b961c6a733d89c73e79f417e72fdd429789b5
SSDEEP

6144:CFDRRjfSaDeg80qXSUCh6jTFRbf0eN0W7cyqCxSn1:CpfUXSUCh6XFRbf0ez0n1

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4060	8077cccc46c5c8f48721da6e8dba50a54c776684ad1d9929367ddc1cfd143557.exe

Executes dropped EXE 1 IoCs

pid	Process
4060	8077cccc46c5c8f48721da6e8dba50a54c776684ad1d9929367ddc1cfd143557.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
3272	4236	WerFault.exe	84
1536	4060	WerFault.exe	88
1140	4060	WerFault.exe	88
468	4060	WerFault.exe	88
2692	4060	WerFault.exe	88
2700	4060	WerFault.exe	88
4512	4060	WerFault.exe	88

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4236	8077cccc46c5c8f48721da6e8dba50a54c776684ad1d9929367ddc1cfd143557.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4060	8077cccc46c5c8f48721da6e8dba50a54c776684ad1d9929367ddc1cfd143557.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 4060	4236	8077cccc46c5c8f48721da6e8dba50a54c776684ad1d9929367ddc1cfd143557.exe	88
PID 4236 wrote to memory of 4060	4236	8077cccc46c5c8f48721da6e8dba50a54c776684ad1d9929367ddc1cfd143557.exe	88
PID 4236 wrote to memory of 4060	4236	8077cccc46c5c8f48721da6e8dba50a54c776684ad1d9929367ddc1cfd143557.exe	88

C:\Users\Admin\AppData\Local\Temp\8077cccc46c5c8f48721da6e8dba50a54c776684ad1d9929367ddc1cfd143557.exe
"C:\Users\Admin\AppData\Local\Temp\8077cccc46c5c8f48721da6e8dba50a54c776684ad1d9929367ddc1cfd143557.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 384
  2⤵
  - Program crash
  PID:3272
- C:\Users\Admin\AppData\Local\Temp\8077cccc46c5c8f48721da6e8dba50a54c776684ad1d9929367ddc1cfd143557.exe
  C:\Users\Admin\AppData\Local\Temp\8077cccc46c5c8f48721da6e8dba50a54c776684ad1d9929367ddc1cfd143557.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 352
    3⤵
    - Program crash
    PID:1536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 768
    3⤵
    - Program crash
    PID:1140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 808
    3⤵
    - Program crash
    PID:468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 816
    3⤵
    - Program crash
    PID:2692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 776
    3⤵
    - Program crash
    PID:2700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 788
    3⤵
    - Program crash
    PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4236 -ip 4236
1⤵
PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4060 -ip 4060
1⤵
PID:3092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4060 -ip 4060
1⤵
PID:968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4060 -ip 4060
1⤵
PID:868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4060 -ip 4060
1⤵
PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4060 -ip 4060
1⤵
PID:4400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4060 -ip 4060
1⤵
PID:3404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8077cccc46c5c8f48721da6e8dba50a54c776684ad1d9929367ddc1cfd143557.exe

Filesize
256KB

MD5
72749f90e8dccaa6ac2c67739cb74aed

SHA1
a09932ed20024ead8b2b5b8921b3c906d39d1c18

SHA256
7794dcddf8ffcc25ed35fa897becf66566fa61831884c07a108b68c80d9451d3

SHA512
2065b32f09748ec1b805b556d283af7edb193868e08f2452416c61dea6c56821ee00b0e6e0650ea7ca62ebde4799634325aedc4ab634b663f5904913af9357ba

Download Submit
memory/4060-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4060-8-0x0000000001500000-0x0000000001540000-memory.dmp

Filesize
256KB

Download
memory/4060-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4236-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4236-6-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download