a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183

General

Target

a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe
Size

453KB
MD5

0ab406aa58cbb45f06e13277bc30ab6c
SHA1

5425c03b0f23631080b9756e4c03dfb5336e07ae
SHA256

a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183
SHA512

3a471fb9634f3d5da1f88017b712d56f9f135c726ffea3c3391de48a63de94559a832ea734d7307d819c166a9082b776487da5274aa97a88e773ae38faa978e2
SSDEEP

6144:vrKJcWk68+hobG1gsZ20W7cyqCxSngmMBqfycuPbUl0i5cD5J6b8pS0wULW:vrWk68+S6ygk0npM4dl0v5JHpS0wULW

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe

pid process

5036 a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe
Executes dropped EXE 1 IoCs

Processes:

a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe

pid process

5036 a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe

pid	process
5036	a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe

pid	process
5036	a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe

Program crash 7 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4480	1804	WerFault.exe	a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe
880	5036	WerFault.exe	a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe
4100	5036	WerFault.exe	a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe
3432	5036	WerFault.exe	a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe
1504	5036	WerFault.exe	a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe
3352	5036	WerFault.exe	a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe
1324	5036	WerFault.exe	a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe

pid process

1804 a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe

pid process

5036 a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe

pid	process
1804	a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe

pid	process
5036	a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe

description	pid	process	target process
PID 1804 wrote to memory of 5036	1804	a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe	a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe
PID 1804 wrote to memory of 5036	1804	a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe	a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe
PID 1804 wrote to memory of 5036	1804	a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe	a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe

C:\Users\Admin\AppData\Local\Temp\a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe
"C:\Users\Admin\AppData\Local\Temp\a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 384
2⤵
- Program crash
PID:4480

C:\Users\Admin\AppData\Local\Temp\a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe
C:\Users\Admin\AppData\Local\Temp\a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe
2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 352
3⤵
- Program crash
PID:880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 772
3⤵
- Program crash
PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 788
3⤵
- Program crash
PID:3432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 812
3⤵
- Program crash
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 780
3⤵
- Program crash
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 852
3⤵
- Program crash
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1804 -ip 1804
1⤵
PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5036 -ip 5036
1⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5036 -ip 5036
1⤵
PID:2500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5036 -ip 5036
1⤵
PID:2516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5036 -ip 5036
1⤵
PID:2796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5036 -ip 5036
1⤵
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5036 -ip 5036
1⤵
PID:3100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a86574f1e606a65881b961f8dd61fab03038e9ce0a36098d25a1a75ee171a183.exe

Filesize
453KB

MD5
18907bb56805ff59b05f4ff1c1959d97

SHA1
4a917ba726a0f594e2a178ac85e6b9061e3e5a4f

SHA256
8f2934d172a4b65f8991f613218a41cba7bcbbe15ce514fa12deb6499670cdcb

SHA512
5fae3c5925de272e36fb856508288b8dbd5fee4ec1bc871b7274a56132437540b657e908d87702514807d399010923ddd0ae800737f4b210a1240256a8dfb866

Download Submit
memory/1804-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1804-6-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5036-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5036-8-0x00000000001A0000-0x00000000001DE000-memory.dmp

Filesize
248KB

Download
memory/5036-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing