98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:48

Target

98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe
Size

944KB
MD5

6bf7e9b6d7dcc5ce465bb69a70216406
SHA1

056b4eeb4e09aa9cb9ea039f93963b49b49ec3d7
SHA256

98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495
SHA512

71bb6022929c17063cade61536ccfa06bd78ebfa36ed6066a38902eefa6238b46a68e32c496ae551c43c920af4ef33e912008509d040f29f53577a31b79cc12d
SSDEEP

6144:kXoNoStDSV7f0D1gLBxWRBTWyrQYVh3U+L777s7U7fhAJOeyje+WofQrmL4hUOzh:pNNk7aWBGtrlLEr7pUdejVDa/ZSZD

Score

7^/10

Deletes itself 1 IoCs

Processes:

98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe

pid process

940 98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe
Executes dropped EXE 1 IoCs

Processes:

98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe

pid process

940 98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe
Loads dropped DLL 4 IoCs

Processes:

98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exeWerFault.exe

pid process

2344 98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe
2728 WerFault.exe
2728 WerFault.exe
2728 WerFault.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2728 940 WerFault.exe 98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe

pid process

2344 98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe

pid process

940 98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe

pid	process
940	98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe

pid	process
940	98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe

pid	process
2344	98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe
2728	WerFault.exe
2728	WerFault.exe
2728	WerFault.exe

pid	pid_target	process	target process
2728	940	WerFault.exe	98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe

pid	process
2344	98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe

pid	process
940	98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe

description	pid	process	target process
PID 2344 wrote to memory of 940	2344	98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe	98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe
PID 2344 wrote to memory of 940	2344	98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe	98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe
PID 2344 wrote to memory of 940	2344	98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe	98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe
PID 2344 wrote to memory of 940	2344	98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe	98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe
PID 940 wrote to memory of 2728	940	98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe	WerFault.exe
PID 940 wrote to memory of 2728	940	98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe	WerFault.exe
PID 940 wrote to memory of 2728	940	98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe	WerFault.exe
PID 940 wrote to memory of 2728	940	98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe	WerFault.exe

\Users\Admin\AppData\Local\Temp\98b6dc68d6f0dbab58cd351fa6eb3a6f7b0442ab64507fe0beb569591a288495.exe
Filesize
944KB

MD5
db050019deac0a8f08867c8d5bc1e14e

SHA1
3e1b0e98f3af68bcf10cac40fdfb9ed2d4b0b8bd

SHA256
cd4af79429ed87f6033fd20702f147542f8dc415717678bc8b3f4308596d11cd

SHA512
96e51fd75ec543029360858effd5c2c888b3797328e8b84e55099fb1fd7ce4653b144d5858fc1a5fce6b8e8929c29147a746c504bda67254bb6c2a64860df969

Download Submit
memory/940-10-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/940-11-0x0000000002F10000-0x0000000002FFC000-memory.dmp

Filesize
944KB

Download
memory/2344-0-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/2344-6-0x00000000030C0000-0x00000000031AC000-memory.dmp

Filesize
944KB

Download
memory/2344-9-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download