a458851ddf51a4880e4d0b8c595a67d862d22f9cc482642e5949571320709a20

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a458851ddf51a4880e4d0b8c595a67d862d22f9cc482642e5949571320709a20.exe
Size

320KB
MD5

14d083da72b9344104b490b90bc4df44
SHA1

39782ba54380478c35763cc9263366634c9fc526
SHA256

a458851ddf51a4880e4d0b8c595a67d862d22f9cc482642e5949571320709a20
SHA512

81b37d7d574c8ab7936512faa1fd5ec50abbc9e5b8c64f011f654dbb09642fa2ac3c8d957cc62378922f684c8e05bcb6782012bc5b8515b26c09885201b5dd13
SSDEEP

6144:I7AZXW/AZZKDwa9Yvi4owkSPJLh1zp9y/453BDu0W7cyqCxSngmMBqfycuPbUl0s:bZXW/AZZKDrZTUB9yw53p80npM4dl0s

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3488	a458851ddf51a4880e4d0b8c595a67d862d22f9cc482642e5949571320709a20.exe

Executes dropped EXE 1 IoCs

pid	Process
3488	a458851ddf51a4880e4d0b8c595a67d862d22f9cc482642e5949571320709a20.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
3064	4296	WerFault.exe	82
4044	3488	WerFault.exe	88
2856	3488	WerFault.exe	88
3224	3488	WerFault.exe	88
4944	3488	WerFault.exe	88
3168	3488	WerFault.exe	88
3576	3488	WerFault.exe	88

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4296	a458851ddf51a4880e4d0b8c595a67d862d22f9cc482642e5949571320709a20.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3488	a458851ddf51a4880e4d0b8c595a67d862d22f9cc482642e5949571320709a20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 3488	4296	a458851ddf51a4880e4d0b8c595a67d862d22f9cc482642e5949571320709a20.exe	88
PID 4296 wrote to memory of 3488	4296	a458851ddf51a4880e4d0b8c595a67d862d22f9cc482642e5949571320709a20.exe	88
PID 4296 wrote to memory of 3488	4296	a458851ddf51a4880e4d0b8c595a67d862d22f9cc482642e5949571320709a20.exe	88

C:\Users\Admin\AppData\Local\Temp\a458851ddf51a4880e4d0b8c595a67d862d22f9cc482642e5949571320709a20.exe
"C:\Users\Admin\AppData\Local\Temp\a458851ddf51a4880e4d0b8c595a67d862d22f9cc482642e5949571320709a20.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 384
  2⤵
  - Program crash
  PID:3064
- C:\Users\Admin\AppData\Local\Temp\a458851ddf51a4880e4d0b8c595a67d862d22f9cc482642e5949571320709a20.exe
  C:\Users\Admin\AppData\Local\Temp\a458851ddf51a4880e4d0b8c595a67d862d22f9cc482642e5949571320709a20.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 352
    3⤵
    - Program crash
    PID:4044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 740
    3⤵
    - Program crash
    PID:2856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 772
    3⤵
    - Program crash
    PID:3224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 740
    3⤵
    - Program crash
    PID:4944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 776
    3⤵
    - Program crash
    PID:3168
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 792
    3⤵
    - Program crash
    PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4296 -ip 4296
1⤵
PID:3792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3488 -ip 3488
1⤵
PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3488 -ip 3488
1⤵
PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3488 -ip 3488
1⤵
PID:380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 3488 -ip 3488
1⤵
PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3488 -ip 3488
1⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3488 -ip 3488
1⤵
PID:4524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a458851ddf51a4880e4d0b8c595a67d862d22f9cc482642e5949571320709a20.exe

Filesize
320KB

MD5
cf980d75b940f626e1990c48ea74480d

SHA1
c119ca65aede39771c1e31d928c403cb9075c926

SHA256
434a21a48905d8c57471cdb1bcbf41896e1f59352f4bb9923b719c52f2c515a9

SHA512
085e9d3b3fa709567b62c36919e9f8a9dc40a3c091fdf7db9c51abe830a5498872eff1b6a23fd95870519b5702f242d3dc4468c3f2e4bffb294fcfc9554d47f2

Download Submit
memory/3488-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3488-8-0x0000000001560000-0x000000000159C000-memory.dmp

Filesize
240KB

Download
memory/3488-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4296-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4296-6-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download