0d2117832c15798fa0e95ae5ced1c0125141a96fe077e7bc1fa0076584531fc0

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 18:45

Target

0d2117832c15798fa0e95ae5ced1c0125141a96fe077e7bc1fa0076584531fc0.exe
Size

384KB
MD5

a82f3e70e6fa2ff6a65e3e769a4ba5d1
SHA1

72823c9c7909c695502dd97fe5914aa662724e42
SHA256

0d2117832c15798fa0e95ae5ced1c0125141a96fe077e7bc1fa0076584531fc0
SHA512

35798ed5d8ac7154668084e6fcf0f0332db7adaf52b9c29bb57a7a9aacf1c7d64f77b69f2e93f6649f26b00f8ff626368337b2dd32829839a32afcea9ecd6489
SSDEEP

12288:mW48zimFGydh7h201jVj0gh6XFRbf0ez0npM4dl0v5Jz:v48zBGIh201Cgh6XFRbf0ezEM4dmv5p

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4524	0d2117832c15798fa0e95ae5ced1c0125141a96fe077e7bc1fa0076584531fc0.exe

Executes dropped EXE 1 IoCs

pid	Process
4524	0d2117832c15798fa0e95ae5ced1c0125141a96fe077e7bc1fa0076584531fc0.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
916	3132	WerFault.exe	78
2116	4524	WerFault.exe	85
4928	4524	WerFault.exe	85
1576	4524	WerFault.exe	85
456	4524	WerFault.exe	85

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3132	0d2117832c15798fa0e95ae5ced1c0125141a96fe077e7bc1fa0076584531fc0.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4524	0d2117832c15798fa0e95ae5ced1c0125141a96fe077e7bc1fa0076584531fc0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 4524	3132	0d2117832c15798fa0e95ae5ced1c0125141a96fe077e7bc1fa0076584531fc0.exe	85
PID 3132 wrote to memory of 4524	3132	0d2117832c15798fa0e95ae5ced1c0125141a96fe077e7bc1fa0076584531fc0.exe	85
PID 3132 wrote to memory of 4524	3132	0d2117832c15798fa0e95ae5ced1c0125141a96fe077e7bc1fa0076584531fc0.exe	85

C:\Users\Admin\AppData\Local\Temp\0d2117832c15798fa0e95ae5ced1c0125141a96fe077e7bc1fa0076584531fc0.exe
"C:\Users\Admin\AppData\Local\Temp\0d2117832c15798fa0e95ae5ced1c0125141a96fe077e7bc1fa0076584531fc0.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 384
  2⤵
  - Program crash
  PID:916
- C:\Users\Admin\AppData\Local\Temp\0d2117832c15798fa0e95ae5ced1c0125141a96fe077e7bc1fa0076584531fc0.exe
  C:\Users\Admin\AppData\Local\Temp\0d2117832c15798fa0e95ae5ced1c0125141a96fe077e7bc1fa0076584531fc0.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 352
    3⤵
    - Program crash
    PID:2116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 772
    3⤵
    - Program crash
    PID:4928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 556
    3⤵
    - Program crash
    PID:1576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 792
    3⤵
    - Program crash
    PID:456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3132 -ip 3132
1⤵
PID:1160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4524 -ip 4524
1⤵
PID:4860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4524 -ip 4524
1⤵
PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4524 -ip 4524
1⤵
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4524 -ip 4524
1⤵
PID:3932

C:\Users\Admin\AppData\Local\Temp\0d2117832c15798fa0e95ae5ced1c0125141a96fe077e7bc1fa0076584531fc0.exe

Filesize
384KB

MD5
9e4d9cd8fccc5d57c57ee2e571e13736

SHA1
9b7484d270446692012a060e110cd68fe71ba99b

SHA256
f74a17ea791d46594f70c73e5adb1d77c6340f3dc371ae2d49442c3b140f8d75

SHA512
7574a0e46f394494132752fe62600579c10306a0a15c242ab3186d1c0488f84cc49d7697ed19858b7804b829761a461f67377f409675b1c8f0b80305d858042b

Download Submit
memory/3132-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3132-6-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4524-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4524-8-0x00000000014D0000-0x0000000001510000-memory.dmp

Filesize
256KB

Download
memory/4524-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download