c5bd0af1e6360c9a9fa695740595c96541bc89db5c19c7ecb5f0b299c9a95a76

Analysis

max time kernel
140s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 02:44

Target

c5bd0af1e6360c9a9fa695740595c96541bc89db5c19c7ecb5f0b299c9a95a76.exe
Size

416KB
MD5

65002ed754758a8927f543f837326dc8
SHA1

10963660bb3910059c2889e909949fdd5b731336
SHA256

c5bd0af1e6360c9a9fa695740595c96541bc89db5c19c7ecb5f0b299c9a95a76
SHA512

ae8450e0d18e91fcea298dd11665758681527fbc424a3194e8d5304be4db9db2a4650d9e33e9b4fa224a33cbe548402ed3cbfd4119ba4b742d0b8cbf151c4956
SSDEEP

6144:zMmCFy+ziioMX/a7Sj8V79H0W7cyqCxSngmMBqfycuPbUl0i5cD5J6KE:zMmezrX/jIV7j0npM4dl0v5JdE

Score

7^/10

Deletes itself 1 IoCs

pid	Process
728	c5bd0af1e6360c9a9fa695740595c96541bc89db5c19c7ecb5f0b299c9a95a76.exe

Executes dropped EXE 1 IoCs

pid	Process
728	c5bd0af1e6360c9a9fa695740595c96541bc89db5c19c7ecb5f0b299c9a95a76.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
1064	1924	WerFault.exe	84
2396	728	WerFault.exe	90
3196	728	WerFault.exe	90
2844	728	WerFault.exe	90
2896	728	WerFault.exe	90

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1924	c5bd0af1e6360c9a9fa695740595c96541bc89db5c19c7ecb5f0b299c9a95a76.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
728	c5bd0af1e6360c9a9fa695740595c96541bc89db5c19c7ecb5f0b299c9a95a76.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 728	1924	c5bd0af1e6360c9a9fa695740595c96541bc89db5c19c7ecb5f0b299c9a95a76.exe	90
PID 1924 wrote to memory of 728	1924	c5bd0af1e6360c9a9fa695740595c96541bc89db5c19c7ecb5f0b299c9a95a76.exe	90
PID 1924 wrote to memory of 728	1924	c5bd0af1e6360c9a9fa695740595c96541bc89db5c19c7ecb5f0b299c9a95a76.exe	90

C:\Users\Admin\AppData\Local\Temp\c5bd0af1e6360c9a9fa695740595c96541bc89db5c19c7ecb5f0b299c9a95a76.exe
"C:\Users\Admin\AppData\Local\Temp\c5bd0af1e6360c9a9fa695740595c96541bc89db5c19c7ecb5f0b299c9a95a76.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 384
  2⤵
  - Program crash
  PID:1064
- C:\Users\Admin\AppData\Local\Temp\c5bd0af1e6360c9a9fa695740595c96541bc89db5c19c7ecb5f0b299c9a95a76.exe
  C:\Users\Admin\AppData\Local\Temp\c5bd0af1e6360c9a9fa695740595c96541bc89db5c19c7ecb5f0b299c9a95a76.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 352
    3⤵
    - Program crash
    PID:2396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 768
    3⤵
    - Program crash
    PID:3196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 788
    3⤵
    - Program crash
    PID:2844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 796
    3⤵
    - Program crash
    PID:2896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1924 -ip 1924
1⤵
PID:2832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 728 -ip 728
1⤵
PID:3672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 728 -ip 728
1⤵
PID:1040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 728 -ip 728
1⤵
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 728 -ip 728
1⤵
PID:3504

C:\Users\Admin\AppData\Local\Temp\c5bd0af1e6360c9a9fa695740595c96541bc89db5c19c7ecb5f0b299c9a95a76.exe

Filesize
416KB

MD5
c3e758d2d5fad7a57558a245fc8c2e24

SHA1
ac206a34468ac1005451ffff56b138c05a02d1bd

SHA256
535ad90be1775bfebbcba795611b639a451989ef7a789cb804d1142027e4339e

SHA512
0af9d91390b6fb34ed3a9be36b5c340f47a3801fb7ada8b7eab24e09837cc3fd0a40a067b0436dd4144c2dc7fdf898ae887982b0fc76fab898d67a5d7243e9de

Download Submit
memory/728-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/728-13-0x00000000014E0000-0x0000000001521000-memory.dmp

Filesize
260KB

Download
memory/728-8-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1924-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1924-6-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download