01e100cfdb783c2714ea21e39ae159358cc05f48409754643655baacbd115aca

Analysis

max time kernel
132s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2024 01:10

Target

01e100cfdb783c2714ea21e39ae159358cc05f48409754643655baacbd115aca.exe
Size

1.1MB
MD5

6dd3fcee83d72a307d0ca48f6da398b0
SHA1

0976eb07bfed46cc79447a40129366ab4c77920c
SHA256

01e100cfdb783c2714ea21e39ae159358cc05f48409754643655baacbd115aca
SHA512

45da22c69eac60dbb36e8c41ba32bf3bc7098b26dda3455038c57716326dc70d9ce1d980949022ccc664c169e082ca586f19dbd138e1a4ab2357f08d99320a01
SSDEEP

24576:TqDEvCTbMWu7rQYlBQcBiT6rprG8a4ArikpaAEU8ie04/aaENU:TTvC/MTQYxsWR7aVmmaNU8fR1E

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
876	4088	WerFault.exe	82

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4088	01e100cfdb783c2714ea21e39ae159358cc05f48409754643655baacbd115aca.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4088	01e100cfdb783c2714ea21e39ae159358cc05f48409754643655baacbd115aca.exe
4088	01e100cfdb783c2714ea21e39ae159358cc05f48409754643655baacbd115aca.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4088	01e100cfdb783c2714ea21e39ae159358cc05f48409754643655baacbd115aca.exe
4088	01e100cfdb783c2714ea21e39ae159358cc05f48409754643655baacbd115aca.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 4924	4088	01e100cfdb783c2714ea21e39ae159358cc05f48409754643655baacbd115aca.exe	86
PID 4088 wrote to memory of 4924	4088	01e100cfdb783c2714ea21e39ae159358cc05f48409754643655baacbd115aca.exe	86
PID 4088 wrote to memory of 4924	4088	01e100cfdb783c2714ea21e39ae159358cc05f48409754643655baacbd115aca.exe	86

C:\Users\Admin\AppData\Local\Temp\01e100cfdb783c2714ea21e39ae159358cc05f48409754643655baacbd115aca.exe
"C:\Users\Admin\AppData\Local\Temp\01e100cfdb783c2714ea21e39ae159358cc05f48409754643655baacbd115aca.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\01e100cfdb783c2714ea21e39ae159358cc05f48409754643655baacbd115aca.exe"
  2⤵
  PID:4924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 704
  2⤵
  - Program crash
  PID:876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4088 -ip 4088
1⤵
PID:2128

C:\Users\Admin\AppData\Local\Temp\aut38E2.tmp

Filesize
261KB

MD5
244e0f6e2bc5ea7db87c2961e52fb66a

SHA1
30941ced5f09b6aedc5e4524d6f85458683eab6b

SHA256
3ef2c6f623d0aacd8bde32505452b00e2c32cfd85b600690d77e50b67945f74e

SHA512
571037aaff68bced9419a10eb705b3a17bde385eec23eaa7a04fce8bec038b0f194b5042e35c227ebc668044824fea49994566436c2e99f2e39a982ca358fcc3

Download Submit
memory/4088-12-0x0000000000D30000-0x0000000000D34000-memory.dmp

Filesize
16KB

Download