49c59699c3a5e2cc0666a12f75ed69a674138a194d40906e3b7843730a5363ed

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 21:18

Target

49c59699c3a5e2cc0666a12f75ed69a674138a194d40906e3b7843730a5363ed.exe
Size

209KB
MD5

012e63c1d3251c98cc4bc9b07c242c4d
SHA1

5e5102af77c3598ee08a24e163d9181c0bac3868
SHA256

49c59699c3a5e2cc0666a12f75ed69a674138a194d40906e3b7843730a5363ed
SHA512

ad7f60b20ffdcc6179099ea89180eff9a868000afa22a766b09d02f628a2f781a015f9dadb0e48f880126d118580987a15983005f8f5b2426ec128323c7c18c4
SSDEEP

3072:+z2g4cXOQQTW9b43i7KG0hcmEnFpyzc4jPCWZo/Wh+jxGCuWefXZV+s:02gCtTQb5KG8EborCW2WhPtfXp

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3696	49c59699c3a5e2cc0666a12f75ed69a674138a194d40906e3b7843730a5363ed.exe

Executes dropped EXE 1 IoCs

pid	Process
3696	49c59699c3a5e2cc0666a12f75ed69a674138a194d40906e3b7843730a5363ed.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3112	3864	WerFault.exe	82
2192	3696	WerFault.exe	88

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3864	49c59699c3a5e2cc0666a12f75ed69a674138a194d40906e3b7843730a5363ed.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3696	49c59699c3a5e2cc0666a12f75ed69a674138a194d40906e3b7843730a5363ed.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 3696	3864	49c59699c3a5e2cc0666a12f75ed69a674138a194d40906e3b7843730a5363ed.exe	88
PID 3864 wrote to memory of 3696	3864	49c59699c3a5e2cc0666a12f75ed69a674138a194d40906e3b7843730a5363ed.exe	88
PID 3864 wrote to memory of 3696	3864	49c59699c3a5e2cc0666a12f75ed69a674138a194d40906e3b7843730a5363ed.exe	88

C:\Users\Admin\AppData\Local\Temp\49c59699c3a5e2cc0666a12f75ed69a674138a194d40906e3b7843730a5363ed.exe
"C:\Users\Admin\AppData\Local\Temp\49c59699c3a5e2cc0666a12f75ed69a674138a194d40906e3b7843730a5363ed.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 396
  2⤵
  - Program crash
  PID:3112
- C:\Users\Admin\AppData\Local\Temp\49c59699c3a5e2cc0666a12f75ed69a674138a194d40906e3b7843730a5363ed.exe
  C:\Users\Admin\AppData\Local\Temp\49c59699c3a5e2cc0666a12f75ed69a674138a194d40906e3b7843730a5363ed.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 364
    3⤵
    - Program crash
    PID:2192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3864 -ip 3864
1⤵
PID:3624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3696 -ip 3696
1⤵
PID:3912

C:\Users\Admin\AppData\Local\Temp\49c59699c3a5e2cc0666a12f75ed69a674138a194d40906e3b7843730a5363ed.exe

Filesize
209KB

MD5
6c84af9272bf3b669a78060c41baf244

SHA1
2cc8c965f77ea1b1af3a4c425d1f54b1039df0fb

SHA256
76ec29105616b44d42e0b1adf4b7e47d6fd1ccd0581cba4b0a50e1388e7069ea

SHA512
578c4934111455e7eb756d0af26dbcfe3f42f004c483dce5c11bdab169e2c69d535ec6fa67eaf3ec1440e75ee5f0cfa545c4b3d1599b3b9442dee44c3a94153c

Download Submit
memory/3696-6-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3696-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3696-13-0x00000000014A0000-0x00000000014E0000-memory.dmp

Filesize
256KB

Download
memory/3864-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3864-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download