161274daed12f112c462e802da7b817275996d071b79d3546a8cd0b42a5023e6

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 18:55

Target

161274daed12f112c462e802da7b817275996d071b79d3546a8cd0b42a5023e6.exe
Size

416KB
MD5

86b2944ddf2530bbff846f83cb7b50c3
SHA1

cec74d7071b44f214d4a2c06737cee869da984b5
SHA256

161274daed12f112c462e802da7b817275996d071b79d3546a8cd0b42a5023e6
SHA512

fe2138969c0976f157e80774d6f63b0a6bf460d399b2680ea5c35083e6ddfd0a50e031d027337d06d061aef333e0acd499907825576ccdbe9fc0fefce83d9561
SSDEEP

6144:QQIagQx6AipNYyVBmX55q5QB26bH3V40saiigCD4H2cHwXWzYpk+mFAH46WKc:Q2DipVwJ5NhVQ5zCD4TyWwiFAH4jKc

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1484	161274daed12f112c462e802da7b817275996d071b79d3546a8cd0b42a5023e6.exe

Executes dropped EXE 1 IoCs

pid	Process
1484	161274daed12f112c462e802da7b817275996d071b79d3546a8cd0b42a5023e6.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
848	1476	WerFault.exe	90
3596	1484	WerFault.exe	95

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1476	161274daed12f112c462e802da7b817275996d071b79d3546a8cd0b42a5023e6.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1484	161274daed12f112c462e802da7b817275996d071b79d3546a8cd0b42a5023e6.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1484	1476	161274daed12f112c462e802da7b817275996d071b79d3546a8cd0b42a5023e6.exe	95
PID 1476 wrote to memory of 1484	1476	161274daed12f112c462e802da7b817275996d071b79d3546a8cd0b42a5023e6.exe	95
PID 1476 wrote to memory of 1484	1476	161274daed12f112c462e802da7b817275996d071b79d3546a8cd0b42a5023e6.exe	95

C:\Users\Admin\AppData\Local\Temp\161274daed12f112c462e802da7b817275996d071b79d3546a8cd0b42a5023e6.exe
"C:\Users\Admin\AppData\Local\Temp\161274daed12f112c462e802da7b817275996d071b79d3546a8cd0b42a5023e6.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 396
  2⤵
  - Program crash
  PID:848
- C:\Users\Admin\AppData\Local\Temp\161274daed12f112c462e802da7b817275996d071b79d3546a8cd0b42a5023e6.exe
  C:\Users\Admin\AppData\Local\Temp\161274daed12f112c462e802da7b817275996d071b79d3546a8cd0b42a5023e6.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 364
    3⤵
    - Program crash
    PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1476 -ip 1476
1⤵
PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1484 -ip 1484
1⤵
PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3984 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:1496

C:\Users\Admin\AppData\Local\Temp\161274daed12f112c462e802da7b817275996d071b79d3546a8cd0b42a5023e6.exe

Filesize
416KB

MD5
cafdc57afdb10e4669a2b83b4eb11084

SHA1
372e10535297927a4c064df69eacae5c0905db6b

SHA256
a156d5a3f75ac75a0d3886c346cb1d4f8905b97bc5ad4f238b0ce61dddcec273

SHA512
292e920be83b9ba188261ae24beaa6669c2daa3e55d493814b2f6dc93c2eae0fe4be9c46e98081af24f2cde864084dbadd5a34c145b1b44c26f42acb61bd2df9

Download Submit
memory/1476-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1476-6-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1484-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1484-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1484-13-0x0000000004D80000-0x0000000004DC0000-memory.dmp

Filesize
256KB

Download