a89e65bc9d8ff21e1381de737e03a3325824f173d4bb306d92ece6c54d1c5884

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 15:48

Target

SoftWare(2).exe
Size

840KB
MD5

74a600df1669384b09dd75dc6bb34017
SHA1

250eed70583094d4b8331f15232d626c204b36f1
SHA256

82160bc5eebc3b8f0f06a8a5cac49f208593f8c2510f636f51a9c269771d9245
SHA512

371bad5b1825b30ae2ea050b02662261ca4817626a20c0bbfcca193c4356dca0936ef5a832cb343d6e26aa450a289cb6e03f747093aa572ac43c8ac9349d82f6
SSDEEP

12288:ctf8SWek8KQsqU+lqYCginzm+ZwDOCGezsVVDgH1Ba2Il4H9h8pP0r772VU7L3cQ:kEZb/glqYCg0zwDo/j

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
3296	SoftWare(2).exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2852	3296	WerFault.exe	81

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 1920	3296	SoftWare(2).exe	83
PID 3296 wrote to memory of 1920	3296	SoftWare(2).exe	83
PID 3296 wrote to memory of 1920	3296	SoftWare(2).exe	83
PID 3296 wrote to memory of 1920	3296	SoftWare(2).exe	83

C:\Users\Admin\AppData\Local\Temp\SoftWare(2).exe
"C:\Users\Admin\AppData\Local\Temp\SoftWare(2).exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 1012
  2⤵
  - Program crash
  PID:2852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3296 -ip 3296
1⤵
PID:4664

C:\Users\Admin\AppData\Roaming\d3d9.dll

Filesize
400KB

MD5
303ce85624027bcd1cdd298c3893cea8

SHA1
ac96919914cc167b3a7f7151b53f3dcb2c2e8c89

SHA256
8783cb9231c1490f9b68e80f55de54c68ece383ae5cfaaef2095553bafb078cf

SHA512
890d141cb874534d15563826ee5c2314eeca2c7624ac87c0a9910027d6627f187b38e47a791884856c1ee3d5ea60db6c11eab52c56c771039e057a038e177904

Download Submit
memory/3296-0-0x0000000074A6E000-0x0000000074A6F000-memory.dmp

Filesize
4KB

Download
memory/3296-1-0x0000000000690000-0x000000000076C000-memory.dmp

Filesize
880KB

Download
memory/3296-2-0x00000000028D0000-0x00000000028D6000-memory.dmp

Filesize
24KB

Download
memory/3296-4-0x0000000074A60000-0x0000000075210000-memory.dmp

Filesize
7.7MB

Download
memory/3296-9-0x0000000074A60000-0x0000000075210000-memory.dmp

Filesize
7.7MB

Download