5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea

Analysis

max time kernel
135s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 22:45

Target

5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe
Size

203KB
MD5

7b02aaa6dd3145e245d892f1f5d96b14
SHA1

5dcac7d9ed1b71bdfc25aa948cf20442e56140e8
SHA256

5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea
SHA512

22984e2b9f34f40dc1003d29c0b6a1ba71c68b8adf9393689796ad9f63ef2c8d318741ef1b44cc453b225dcedca56e74e53f80131f3e59761ef0bfb72ffcebfd
SSDEEP

3072:4biWU9r1KCs4tlSVJeY7YRI8oMG4lEJGMsget:4bNUzgQG8lssZ

Score

7^/10

Deletes itself 1 IoCs

Processes:

5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe

pid process

4804 5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe
Executes dropped EXE 1 IoCs

Processes:

5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe

pid process

4804 5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe

pid	process
4804	5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe

pid	process
4804	5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe

Program crash 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4724	1432	WerFault.exe	5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe
4192	4804	WerFault.exe	5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe
1248	4804	WerFault.exe	5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe
4208	4804	WerFault.exe	5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe
548	4804	WerFault.exe	5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe
752	4804	WerFault.exe	5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe

pid process

1432 5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe

pid process

4804 5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe

pid	process
1432	5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe

pid	process
4804	5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe

description	pid	process	target process
PID 1432 wrote to memory of 4804	1432	5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe	5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe
PID 1432 wrote to memory of 4804	1432	5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe	5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe
PID 1432 wrote to memory of 4804	1432	5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe	5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe

C:\Users\Admin\AppData\Local\Temp\5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe
"C:\Users\Admin\AppData\Local\Temp\5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 384
  2⤵
  - Program crash
  PID:4724
- C:\Users\Admin\AppData\Local\Temp\5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe
  C:\Users\Admin\AppData\Local\Temp\5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 352
    3⤵
    - Program crash
    PID:4192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 768
    3⤵
    - Program crash
    PID:1248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 788
    3⤵
    - Program crash
    PID:4208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 796
    3⤵
    - Program crash
    PID:548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 544
    3⤵
    - Program crash
    PID:752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1432 -ip 1432
1⤵
PID:3216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4804 -ip 4804
1⤵
PID:2812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4804 -ip 4804
1⤵
PID:728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4804 -ip 4804
1⤵
PID:1148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4804 -ip 4804
1⤵
PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4804 -ip 4804
1⤵
PID:1360

C:\Users\Admin\AppData\Local\Temp\5ada06e081169bab16472d8692188f9930ab6f3e4849d7b5140e397b4c5e4bea.exe

Filesize
203KB

MD5
995501edd6b73bc56d1ca143914a58fc

SHA1
a58a197737e54f5e28fb4236b13045af8429694d

SHA256
ee7acff76ae6fe65c0d5b605371293d563c06466b484131fa780a9ee22ec62f6

SHA512
58355f7eab43c8e5da0499356128c81fd97bbde5c0aeb8d6fb97e6564b678cf15bb324f42a45424ed8f2e0ad3ff4cd59f6015f63538b7b4da2a7bc39167df935

Download Submit
memory/1432-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1432-6-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4804-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4804-8-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4804-13-0x00000000014A0000-0x00000000014DE000-memory.dmp

Filesize
248KB

Download