e2748ea17c88d21377252925a8a4f69e4c3ac74002733a02125e63027f33f652

Analysis

max time kernel
147s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 02:13

Target

e2748ea17c88d21377252925a8a4f69e4c3ac74002733a02125e63027f33f652.exe
Size

194KB
MD5

75620052eeaa55a9a52fe8008f4cee9b
SHA1

96807a8c9d3660ede2387689f310634519e92449
SHA256

e2748ea17c88d21377252925a8a4f69e4c3ac74002733a02125e63027f33f652
SHA512

1c3e2ad803dbe5c79b52b443cd52cbc628a790893e9ab0e3bdfcf7eb648d2312bc9627150b3a36d20345407c47438318a021ae337fffc445082edad738169813
SSDEEP

3072:b28gf8MEmvmIFonpvwSF2SjahDYI93iK7GgE3PZeJ6Zwy6:y8gEbm64W2SE93i8KBeJ6Z

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4868	e2748ea17c88d21377252925a8a4f69e4c3ac74002733a02125e63027f33f652.exe

Executes dropped EXE 1 IoCs

pid	Process
4868	e2748ea17c88d21377252925a8a4f69e4c3ac74002733a02125e63027f33f652.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1040	3116	WerFault.exe	84
4060	4868	WerFault.exe	91
4620	4868	WerFault.exe	91

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3116	e2748ea17c88d21377252925a8a4f69e4c3ac74002733a02125e63027f33f652.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4868	e2748ea17c88d21377252925a8a4f69e4c3ac74002733a02125e63027f33f652.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 4868	3116	e2748ea17c88d21377252925a8a4f69e4c3ac74002733a02125e63027f33f652.exe	91
PID 3116 wrote to memory of 4868	3116	e2748ea17c88d21377252925a8a4f69e4c3ac74002733a02125e63027f33f652.exe	91
PID 3116 wrote to memory of 4868	3116	e2748ea17c88d21377252925a8a4f69e4c3ac74002733a02125e63027f33f652.exe	91

C:\Users\Admin\AppData\Local\Temp\e2748ea17c88d21377252925a8a4f69e4c3ac74002733a02125e63027f33f652.exe
"C:\Users\Admin\AppData\Local\Temp\e2748ea17c88d21377252925a8a4f69e4c3ac74002733a02125e63027f33f652.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 424
  2⤵
  - Program crash
  PID:1040
- C:\Users\Admin\AppData\Local\Temp\e2748ea17c88d21377252925a8a4f69e4c3ac74002733a02125e63027f33f652.exe
  C:\Users\Admin\AppData\Local\Temp\e2748ea17c88d21377252925a8a4f69e4c3ac74002733a02125e63027f33f652.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 392
    3⤵
    - Program crash
    PID:4060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 392
    3⤵
    - Program crash
    PID:4620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3116 -ip 3116
1⤵
PID:3664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4868 -ip 4868
1⤵
PID:4768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4868 -ip 4868
1⤵
PID:3032

C:\Users\Admin\AppData\Local\Temp\e2748ea17c88d21377252925a8a4f69e4c3ac74002733a02125e63027f33f652.exe

Filesize
194KB

MD5
19fe0e7af567c0b3db7db017ff0c7db2

SHA1
b8fef9480b4e504c954bce1c5014159f5419e31c

SHA256
0352c9adda7e88041aae01982c5aa11815a8abf3f281b82c719ab588b28d84ae

SHA512
f51530bec9d91582dbc44ac36939f0072b93723ad10980da7474b89e74cfd3530550232db47def8583f9263a7ef87ca15b81f7c51cc66a3966b431a33647babb

Download Submit
memory/3116-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3116-7-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4868-6-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4868-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4868-13-0x00000000014A0000-0x00000000014D9000-memory.dmp

Filesize
228KB

Download