393d96b713accdb99bb6663932284eed024d91d2ee7d7cd9f71a4600d5ea81ec

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02-05-2024 20:38

Target

393d96b713accdb99bb6663932284eed024d91d2ee7d7cd9f71a4600d5ea81ec.exe
Size

512KB
MD5

b45791d23a867bdcf3c40e3f4cb00734
SHA1

903a64f410ed9913eb5f1615df023583e5a0ce03
SHA256

393d96b713accdb99bb6663932284eed024d91d2ee7d7cd9f71a4600d5ea81ec
SHA512

5826d86daeeed19032d5fab0dcb36133c07e4542e268c8dec93104cfb79dc35d6b39ccd9045b4a1ffd6a9cccc4316cb08040f31735746610c5c18957a0a62f54
SSDEEP

12288:XJmFV9qLTSwhBQcN+OKLcfNcd7RSjNlyrW4o:XkFVaTSwF1mdlOj4o

Score

9^/10

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/memory/2180-0-0x0000000063080000-0x00000000631EC000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing base64 encoded User Agent 1 IoCs

resource	yara_rule
behavioral1/memory/2180-0-0x0000000063080000-0x00000000631EC000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_B64_Encoded_UserAgent

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2924	2180	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2180	393d96b713accdb99bb6663932284eed024d91d2ee7d7cd9f71a4600d5ea81ec.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2924	2180	393d96b713accdb99bb6663932284eed024d91d2ee7d7cd9f71a4600d5ea81ec.exe	28
PID 2180 wrote to memory of 2924	2180	393d96b713accdb99bb6663932284eed024d91d2ee7d7cd9f71a4600d5ea81ec.exe	28
PID 2180 wrote to memory of 2924	2180	393d96b713accdb99bb6663932284eed024d91d2ee7d7cd9f71a4600d5ea81ec.exe	28
PID 2180 wrote to memory of 2924	2180	393d96b713accdb99bb6663932284eed024d91d2ee7d7cd9f71a4600d5ea81ec.exe	28

C:\Users\Admin\AppData\Local\Temp\393d96b713accdb99bb6663932284eed024d91d2ee7d7cd9f71a4600d5ea81ec.exe
"C:\Users\Admin\AppData\Local\Temp\393d96b713accdb99bb6663932284eed024d91d2ee7d7cd9f71a4600d5ea81ec.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 268
  2⤵
  - Program crash
  PID:2924

memory/2180-0-0x0000000063080000-0x00000000631EC000-memory.dmp

Filesize
1.4MB

Download
memory/2180-12-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download