8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:01

Target

8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c.exe
Size

213KB
MD5

b1db8bb0a61ee6c4bd6ecbf7b5037d2e
SHA1

203cb1f899e7569b646e80583724d0b1611f06ad
SHA256

8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c
SHA512

a3f170311377468b0c80fb25cfcb2fd600f7fa3f1a36a4e71e373f9c2c0ee5176c1951fab09b9a0b7b2f812fc8f1533167ce83663192ae83aecbe0d00f9b3d54
SSDEEP

6144:h3ByACVggRC0dRoU+5/9ZEGLlVagS7tDH0:dUligRfWUEUWlValJDH0

Score

7^/10

Deletes itself 1 IoCs

Processes:

8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c.exe

pid process

2944 8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c.exe
Executes dropped EXE 1 IoCs

Processes:

8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c.exe

pid process

2944 8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c.exe

pid	process
2944	8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c.exe

pid	process
2944	8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
3468	4908	WerFault.exe	8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c.exe
2720	2944	WerFault.exe	8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c.exe

pid process

4908 8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c.exe

pid process

2944 8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c.exe

pid	process
4908	8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c.exe

pid	process
2944	8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c.exe

description	pid	process	target process
PID 4908 wrote to memory of 2944	4908	8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c.exe	8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c.exe
PID 4908 wrote to memory of 2944	4908	8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c.exe	8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c.exe
PID 4908 wrote to memory of 2944	4908	8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c.exe	8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 376
2⤵
- Program crash
PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 364
3⤵
- Program crash
PID:2720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4908 -ip 4908
1⤵
PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2944 -ip 2944
1⤵
PID:440

C:\Users\Admin\AppData\Local\Temp\8f57b94d3c9a7b565fec5a89dda7e1da604548776cfffa0d3e92b02683fb8a4c.exe
Filesize
213KB

MD5
ab393b92dd5a841d432507830c80ff8a

SHA1
69249622cdd9e5de34586439e2ff7e3acb88e6d6

SHA256
c5e9cfd45563b40e66adda3b2718042ce04b6cc3f4bcad2845e3a8e9e264101a

SHA512
87572c69af79c09eb8575a8c33e4d31953a6b7d71d71eeaf11995ff3acabbfa81439c49c3b5c50684477100579fe9c230c590a49a7a26f496680cb51ef31a734

Download Submit
memory/2944-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2944-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2944-13-0x00000000014D0000-0x0000000001511000-memory.dmp

Filesize
260KB

Download
memory/4908-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4908-6-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download