94f34dfefdb0bd40a916355b886edc85f90076ee9239a9e9097e0f4c1a8649aa

Analysis

max time kernel
132s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05-06-2024 00:40

Target

94f34dfefdb0bd40a916355b886edc85f90076ee9239a9e9097e0f4c1a8649aa.exe
Size

320KB
MD5

1506a39bb0aaf3e201e2893ec08f2c3f
SHA1

74e2185bbb70b00162aa7499b87125ec3b81243a
SHA256

94f34dfefdb0bd40a916355b886edc85f90076ee9239a9e9097e0f4c1a8649aa
SHA512

90e0e4c58939748e539ee7a461e104b585e07389f1d110481517eb38a2c1139fe05afbe12a921384511da4762f28fb69c50a412f99d8741bc73293a1801d56fc
SSDEEP

6144:sKyXnRl7XdvPNQOSPb3Y3Xd8GVwMr6UwGU6qG1B7qV40saiigCDN:s5bdvPNFSPb3sXd8GVwMmUwGU6qG1Bmx

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3680	94f34dfefdb0bd40a916355b886edc85f90076ee9239a9e9097e0f4c1a8649aa.exe

Executes dropped EXE 1 IoCs

pid	Process
3680	94f34dfefdb0bd40a916355b886edc85f90076ee9239a9e9097e0f4c1a8649aa.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
816	924	WerFault.exe	81
2104	3680	WerFault.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
924	94f34dfefdb0bd40a916355b886edc85f90076ee9239a9e9097e0f4c1a8649aa.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3680	94f34dfefdb0bd40a916355b886edc85f90076ee9239a9e9097e0f4c1a8649aa.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 3680	924	94f34dfefdb0bd40a916355b886edc85f90076ee9239a9e9097e0f4c1a8649aa.exe	89
PID 924 wrote to memory of 3680	924	94f34dfefdb0bd40a916355b886edc85f90076ee9239a9e9097e0f4c1a8649aa.exe	89
PID 924 wrote to memory of 3680	924	94f34dfefdb0bd40a916355b886edc85f90076ee9239a9e9097e0f4c1a8649aa.exe	89

C:\Users\Admin\AppData\Local\Temp\94f34dfefdb0bd40a916355b886edc85f90076ee9239a9e9097e0f4c1a8649aa.exe
"C:\Users\Admin\AppData\Local\Temp\94f34dfefdb0bd40a916355b886edc85f90076ee9239a9e9097e0f4c1a8649aa.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 396
  2⤵
  - Program crash
  PID:816
- C:\Users\Admin\AppData\Local\Temp\94f34dfefdb0bd40a916355b886edc85f90076ee9239a9e9097e0f4c1a8649aa.exe
  C:\Users\Admin\AppData\Local\Temp\94f34dfefdb0bd40a916355b886edc85f90076ee9239a9e9097e0f4c1a8649aa.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 364
    3⤵
    - Program crash
    PID:2104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 924 -ip 924
1⤵
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3680 -ip 3680
1⤵
PID:3456

C:\Users\Admin\AppData\Local\Temp\94f34dfefdb0bd40a916355b886edc85f90076ee9239a9e9097e0f4c1a8649aa.exe

Filesize
320KB

MD5
8241112080dfd67fe506f94cb44bd64c

SHA1
823c2a54eb47d7ea7ccc6e71ea7cb55d6233591c

SHA256
42fd30d05349d52bf04a60c0eb70338a2c5ff50df45e9f469be58f7fc7aa9425

SHA512
f4c1e8dc41b42ee2965417d2489765a093c8bb97f05ea13d6dd1753a2b9d00843c8a33a4459c94eaab9f1cf2372b565f387b7f7bc5b67697197bbc76dafaaa63

Download Submit
memory/924-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/924-7-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3680-6-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3680-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3680-13-0x00000000014A0000-0x00000000014DF000-memory.dmp

Filesize
252KB

Download