393d96b713accdb99bb6663932284eed024d91d2ee7d7cd9f71a4600d5ea81ec

Analysis

max time kernel
139s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 20:38

Target

393d96b713accdb99bb6663932284eed024d91d2ee7d7cd9f71a4600d5ea81ec.exe
Size

512KB
MD5

b45791d23a867bdcf3c40e3f4cb00734
SHA1

903a64f410ed9913eb5f1615df023583e5a0ce03
SHA256

393d96b713accdb99bb6663932284eed024d91d2ee7d7cd9f71a4600d5ea81ec
SHA512

5826d86daeeed19032d5fab0dcb36133c07e4542e268c8dec93104cfb79dc35d6b39ccd9045b4a1ffd6a9cccc4316cb08040f31735746610c5c18957a0a62f54
SSDEEP

12288:XJmFV9qLTSwhBQcN+OKLcfNcd7RSjNlyrW4o:XkFVaTSwF1mdlOj4o

Score

9^/10

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/memory/2656-0-0x0000000063080000-0x00000000631EC000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing base64 encoded User Agent 1 IoCs

resource	yara_rule
behavioral2/memory/2656-0-0x0000000063080000-0x00000000631EC000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_B64_Encoded_UserAgent

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1940	2656	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2656	393d96b713accdb99bb6663932284eed024d91d2ee7d7cd9f71a4600d5ea81ec.exe
2656	393d96b713accdb99bb6663932284eed024d91d2ee7d7cd9f71a4600d5ea81ec.exe

C:\Users\Admin\AppData\Local\Temp\393d96b713accdb99bb6663932284eed024d91d2ee7d7cd9f71a4600d5ea81ec.exe
"C:\Users\Admin\AppData\Local\Temp\393d96b713accdb99bb6663932284eed024d91d2ee7d7cd9f71a4600d5ea81ec.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 792
  2⤵
  - Program crash
  PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2656 -ip 2656
1⤵
PID:4448

memory/2656-0-0x0000000063080000-0x00000000631EC000-memory.dmp

Filesize
1.4MB

Download
memory/2656-13-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download