d0dad2c74979a1cb3a0c4fe9435853698dfa1001992272622e624d6199b77f48

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 07:51

Target

d0dad2c74979a1cb3a0c4fe9435853698dfa1001992272622e624d6199b77f48.exe
Size

2.4MB
MD5

db08feef352cb81eb2a058b6660c2155
SHA1

cf8768d3b7af310a92087f8045244ecfccd2729f
SHA256

d0dad2c74979a1cb3a0c4fe9435853698dfa1001992272622e624d6199b77f48
SHA512

00010029d2552d6fd910238f4e3d44cebdb563a47195d9aca3fae08baf7a358aaf1c6f14c84b4035a72d6e81188595da2e4bdb66f291d29f52143a9c922cd012
SSDEEP

24576:jTTXB0woras9a/ZS7W+iniF+ujZXIMfX2av5SAODFDn:XT0rF9gMPiniXtXIMfX2wGBDn

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2808	d0dad2c74979a1cb3a0c4fe9435853698dfa1001992272622e624d6199b77f48.exe

Executes dropped EXE 1 IoCs

pid	Process
2808	d0dad2c74979a1cb3a0c4fe9435853698dfa1001992272622e624d6199b77f48.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2452	4160	WerFault.exe	92
2176	2808	WerFault.exe	100
1696	2808	WerFault.exe	100

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4160	d0dad2c74979a1cb3a0c4fe9435853698dfa1001992272622e624d6199b77f48.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2808	d0dad2c74979a1cb3a0c4fe9435853698dfa1001992272622e624d6199b77f48.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 2808	4160	d0dad2c74979a1cb3a0c4fe9435853698dfa1001992272622e624d6199b77f48.exe	100
PID 4160 wrote to memory of 2808	4160	d0dad2c74979a1cb3a0c4fe9435853698dfa1001992272622e624d6199b77f48.exe	100
PID 4160 wrote to memory of 2808	4160	d0dad2c74979a1cb3a0c4fe9435853698dfa1001992272622e624d6199b77f48.exe	100

C:\Users\Admin\AppData\Local\Temp\d0dad2c74979a1cb3a0c4fe9435853698dfa1001992272622e624d6199b77f48.exe
"C:\Users\Admin\AppData\Local\Temp\d0dad2c74979a1cb3a0c4fe9435853698dfa1001992272622e624d6199b77f48.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 344
  2⤵
  - Program crash
  PID:2452
- C:\Users\Admin\AppData\Local\Temp\d0dad2c74979a1cb3a0c4fe9435853698dfa1001992272622e624d6199b77f48.exe
  C:\Users\Admin\AppData\Local\Temp\d0dad2c74979a1cb3a0c4fe9435853698dfa1001992272622e624d6199b77f48.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 344
    3⤵
    - Program crash
    PID:2176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 360
    3⤵
    - Program crash
    PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4160 -ip 4160
1⤵
PID:784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2808 -ip 2808
1⤵
PID:264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2808 -ip 2808
1⤵
PID:4016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1036,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:8
1⤵
PID:4896

C:\Users\Admin\AppData\Local\Temp\d0dad2c74979a1cb3a0c4fe9435853698dfa1001992272622e624d6199b77f48.exe

Filesize
2.4MB

MD5
de62a878b757c861287d20eec52f653c

SHA1
5f3d36a2c66a4fc82fc02907d4e0e03887812272

SHA256
ada60bc92c316b871f4b8e2ba38b6c7724017e62594ec79ea2d282068c0c1ac3

SHA512
95647c861589094b78ae518df8bf2ebbfa16e468c2551ead8c457803472dc8b6475bd02728e3ef435ac738a6b2d2414243e4027cb49109d4f29c18de23c0cc71

Download Submit
memory/2808-7-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2808-8-0x0000000005170000-0x0000000005260000-memory.dmp

Filesize
960KB

Download
memory/2808-10-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4160-0-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/4160-6-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download