9ee5aa12e00a93dce8ac75f503a5a5d9a6aa8d025ca38def0e2a18bd46d2a619

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 02:15

Target

9ee5aa12e00a93dce8ac75f503a5a5d9a6aa8d025ca38def0e2a18bd46d2a619.exe
Size

288KB
MD5

c43834acaf8ccdb18034c0b098f5309a
SHA1

ca3c180741d7a7d6b8c3ecfd2dd16800b91ce12b
SHA256

9ee5aa12e00a93dce8ac75f503a5a5d9a6aa8d025ca38def0e2a18bd46d2a619
SHA512

251abae05a909011eedd4b14d9d2d3112a0c385f4d3f6b9d7348ec4c88006befd00d0a09369af8f611e0b4dbd53d3fa6d49ef1fac3755cae21a600bb31465893
SSDEEP

6144:2GsKaprIaEEGsO8iqvMbfvuJtPGPYRAddGVtdW/sEM+rW+0gM7uRw0sNV:ElprUElO8i2Mb3uJIwRhVtdW/sEzrWtJ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4748	9ee5aa12e00a93dce8ac75f503a5a5d9a6aa8d025ca38def0e2a18bd46d2a619.exe

Executes dropped EXE 1 IoCs

pid	Process
4748	9ee5aa12e00a93dce8ac75f503a5a5d9a6aa8d025ca38def0e2a18bd46d2a619.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5072	1480	WerFault.exe	82
4892	4748	WerFault.exe	90

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1480	9ee5aa12e00a93dce8ac75f503a5a5d9a6aa8d025ca38def0e2a18bd46d2a619.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4748	9ee5aa12e00a93dce8ac75f503a5a5d9a6aa8d025ca38def0e2a18bd46d2a619.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 4748	1480	9ee5aa12e00a93dce8ac75f503a5a5d9a6aa8d025ca38def0e2a18bd46d2a619.exe	90
PID 1480 wrote to memory of 4748	1480	9ee5aa12e00a93dce8ac75f503a5a5d9a6aa8d025ca38def0e2a18bd46d2a619.exe	90
PID 1480 wrote to memory of 4748	1480	9ee5aa12e00a93dce8ac75f503a5a5d9a6aa8d025ca38def0e2a18bd46d2a619.exe	90

C:\Users\Admin\AppData\Local\Temp\9ee5aa12e00a93dce8ac75f503a5a5d9a6aa8d025ca38def0e2a18bd46d2a619.exe
"C:\Users\Admin\AppData\Local\Temp\9ee5aa12e00a93dce8ac75f503a5a5d9a6aa8d025ca38def0e2a18bd46d2a619.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 396
  2⤵
  - Program crash
  PID:5072
- C:\Users\Admin\AppData\Local\Temp\9ee5aa12e00a93dce8ac75f503a5a5d9a6aa8d025ca38def0e2a18bd46d2a619.exe
  C:\Users\Admin\AppData\Local\Temp\9ee5aa12e00a93dce8ac75f503a5a5d9a6aa8d025ca38def0e2a18bd46d2a619.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 376
    3⤵
    - Program crash
    PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1480 -ip 1480
1⤵
PID:516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4748 -ip 4748
1⤵
PID:2124

C:\Users\Admin\AppData\Local\Temp\9ee5aa12e00a93dce8ac75f503a5a5d9a6aa8d025ca38def0e2a18bd46d2a619.exe

Filesize
288KB

MD5
b0ce03fdafaa4b3c05b2b445d37c72fe

SHA1
dec0643f14b66dd23c8ea0ea16f10e1805253bef

SHA256
bacc2137d2ca444d41b6c78de14edc8fc3da4921be976b0159951905ad0fc20a

SHA512
5a12c3aab7012ef916e36ed62c9bac629f32bd0e3d2832120401c92dadf0de07d60b4a4a11970f027565c8d64d2582a7c24a35b2d6d424fff75d647400001d93

Download Submit
memory/1480-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1480-6-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4748-7-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4748-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4748-13-0x0000000001520000-0x0000000001557000-memory.dmp

Filesize
220KB

Download