87bf1902cbc2282c22e10f492b25b872e756a4f332b68a725c5e1549b6d36d94

Analysis

max time kernel
140s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 00:04

Target

87bf1902cbc2282c22e10f492b25b872e756a4f332b68a725c5e1549b6d36d94.exe
Size

197KB
MD5

0e7811a734f4e4d3102e9f084e3a6266
SHA1

3376880cf55632d2dc74bb6a5cf7d53464bf9b72
SHA256

87bf1902cbc2282c22e10f492b25b872e756a4f332b68a725c5e1549b6d36d94
SHA512

3b9d54488b25d4c807a1494e1408629daac73697b31f972ced2b1d2d025044ebaf5a21a8273150235b546e98fbcebfda20b67c6d3f4092f4c1c4a13a794b3869
SSDEEP

6144:JH6qZ5EakZF9CKwmJ0q/a7i4QCyGH6Y6l:JHV5YCK0qoirCyfv

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4052	87bf1902cbc2282c22e10f492b25b872e756a4f332b68a725c5e1549b6d36d94.exe

Executes dropped EXE 1 IoCs

pid	Process
4052	87bf1902cbc2282c22e10f492b25b872e756a4f332b68a725c5e1549b6d36d94.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2848	2964	WerFault.exe	86
1320	4052	WerFault.exe	93
3944	4052	WerFault.exe	93
3556	4052	WerFault.exe	93
636	4052	WerFault.exe	93

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2964	87bf1902cbc2282c22e10f492b25b872e756a4f332b68a725c5e1549b6d36d94.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4052	87bf1902cbc2282c22e10f492b25b872e756a4f332b68a725c5e1549b6d36d94.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 4052	2964	87bf1902cbc2282c22e10f492b25b872e756a4f332b68a725c5e1549b6d36d94.exe	93
PID 2964 wrote to memory of 4052	2964	87bf1902cbc2282c22e10f492b25b872e756a4f332b68a725c5e1549b6d36d94.exe	93
PID 2964 wrote to memory of 4052	2964	87bf1902cbc2282c22e10f492b25b872e756a4f332b68a725c5e1549b6d36d94.exe	93

C:\Users\Admin\AppData\Local\Temp\87bf1902cbc2282c22e10f492b25b872e756a4f332b68a725c5e1549b6d36d94.exe
"C:\Users\Admin\AppData\Local\Temp\87bf1902cbc2282c22e10f492b25b872e756a4f332b68a725c5e1549b6d36d94.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 384
  2⤵
  - Program crash
  PID:2848
- C:\Users\Admin\AppData\Local\Temp\87bf1902cbc2282c22e10f492b25b872e756a4f332b68a725c5e1549b6d36d94.exe
  C:\Users\Admin\AppData\Local\Temp\87bf1902cbc2282c22e10f492b25b872e756a4f332b68a725c5e1549b6d36d94.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 360
    3⤵
    - Program crash
    PID:1320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 768
    3⤵
    - Program crash
    PID:3944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 772
    3⤵
    - Program crash
    PID:3556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 768
    3⤵
    - Program crash
    PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2964 -ip 2964
1⤵
PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4052 -ip 4052
1⤵
PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4052 -ip 4052
1⤵
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4052 -ip 4052
1⤵
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4052 -ip 4052
1⤵
PID:4576

C:\Users\Admin\AppData\Local\Temp\87bf1902cbc2282c22e10f492b25b872e756a4f332b68a725c5e1549b6d36d94.exe

Filesize
197KB

MD5
bbca0299ff1209c6b7c2cc0784d6e444

SHA1
c197fad1b67822f5d4f780a7454b812f729e6677

SHA256
4fc9b334b3088ce00ec04bcafa39e07735381a2f2ddfdf9c44ab28d8091389d8

SHA512
def4139684f45111bf7f6689bc4b10dd71331f01b883578c9637453ff0283f50dc9a213174a1fc89c322df8dd1824dfe30c4645ebc4eba8e4065ba3373c2b86a

Download Submit
memory/2964-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2964-6-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4052-7-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4052-8-0x0000000000150000-0x000000000018F000-memory.dmp

Filesize
252KB

Download
memory/4052-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4052-14-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download