cc072f86c9f81277d1c0457eb077a8a8331f9978bda31f5e952b684f1b6e0a52

Analysis

max time kernel
145s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 02:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc072f86c9f81277d1c0457eb077a8a8331f9978bda31f5e952b684f1b6e0a52.exe
Size

425KB
MD5

5000f4e125d49a79a0bacbd69d450bd5
SHA1

3cae31889a29111a373a12c8da34c8c474ff2f45
SHA256

cc072f86c9f81277d1c0457eb077a8a8331f9978bda31f5e952b684f1b6e0a52
SHA512

d1561f3d0d027f4c605ed5610e054cca8bd487cd7b7a2210c74791792923a8b713690767653ed9974ed5ec6d5a214f67fdc0c5a9f25759500096c341aa95b1de
SSDEEP

12288:Xedc6GRnHhWc1+Lj1f1C+ffZMcQUZn2qhg2kD44zzrGEPVQ:ua6gHhWc1+Lj1f1C+ffZMcQUZn2qhg2P

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3396	cc072f86c9f81277d1c0457eb077a8a8331f9978bda31f5e952b684f1b6e0a52.exe

Executes dropped EXE 1 IoCs

pid	Process
3396	cc072f86c9f81277d1c0457eb077a8a8331f9978bda31f5e952b684f1b6e0a52.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
4996	4520	WerFault.exe	82
5020	3396	WerFault.exe	87
3348	3396	WerFault.exe	87
2692	3396	WerFault.exe	87
2524	3396	WerFault.exe	87
4056	3396	WerFault.exe	87
4880	3396	WerFault.exe	87

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4520	cc072f86c9f81277d1c0457eb077a8a8331f9978bda31f5e952b684f1b6e0a52.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3396	cc072f86c9f81277d1c0457eb077a8a8331f9978bda31f5e952b684f1b6e0a52.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 3396	4520	cc072f86c9f81277d1c0457eb077a8a8331f9978bda31f5e952b684f1b6e0a52.exe	87
PID 4520 wrote to memory of 3396	4520	cc072f86c9f81277d1c0457eb077a8a8331f9978bda31f5e952b684f1b6e0a52.exe	87
PID 4520 wrote to memory of 3396	4520	cc072f86c9f81277d1c0457eb077a8a8331f9978bda31f5e952b684f1b6e0a52.exe	87

C:\Users\Admin\AppData\Local\Temp\cc072f86c9f81277d1c0457eb077a8a8331f9978bda31f5e952b684f1b6e0a52.exe
"C:\Users\Admin\AppData\Local\Temp\cc072f86c9f81277d1c0457eb077a8a8331f9978bda31f5e952b684f1b6e0a52.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 384
  2⤵
  - Program crash
  PID:4996
- C:\Users\Admin\AppData\Local\Temp\cc072f86c9f81277d1c0457eb077a8a8331f9978bda31f5e952b684f1b6e0a52.exe
  C:\Users\Admin\AppData\Local\Temp\cc072f86c9f81277d1c0457eb077a8a8331f9978bda31f5e952b684f1b6e0a52.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 352
    3⤵
    - Program crash
    PID:5020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 768
    3⤵
    - Program crash
    PID:3348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 788
    3⤵
    - Program crash
    PID:2692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 776
    3⤵
    - Program crash
    PID:2524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 788
    3⤵
    - Program crash
    PID:4056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 772
    3⤵
    - Program crash
    PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4520 -ip 4520
1⤵
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3396 -ip 3396
1⤵
PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3396 -ip 3396
1⤵
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3396 -ip 3396
1⤵
PID:2992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3396 -ip 3396
1⤵
PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3396 -ip 3396
1⤵
PID:1976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3396 -ip 3396
1⤵
PID:4092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cc072f86c9f81277d1c0457eb077a8a8331f9978bda31f5e952b684f1b6e0a52.exe

Filesize
425KB

MD5
9dc4888ae90451e3a3fa2f060cb2c360

SHA1
b034f44efd532622a9c987ce9cbe97854a0679b8

SHA256
47a8093e7f05acf6582475ee958d8921857dd1b2644b8865df079148476f6226

SHA512
e6a2dd07400c53438239107afa84377fddc74969202027046613eaf4b29c052598f157f5901c150c639dfa9d97ac642380cfc6c0183a8a885fc777c2828486dc

Download Submit
memory/3396-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3396-9-0x00000000014D0000-0x0000000001503000-memory.dmp

Filesize
204KB

Download
memory/3396-10-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4520-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4520-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download