4ca30b18132145bea2996fcf79a2f9574eac0283e86b4d69ef0ace3c0167bb1e

Analysis

max time kernel
145s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 23:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ca30b18132145bea2996fcf79a2f9574eac0283e86b4d69ef0ace3c0167bb1e.exe
Size

197KB
MD5

0d7a32a8ad959597a447de5718328346
SHA1

b2072f69316f34bcb03dbe3995f8ac465b090408
SHA256

4ca30b18132145bea2996fcf79a2f9574eac0283e86b4d69ef0ace3c0167bb1e
SHA512

69a9bb30c9ade2b33cf1f060b75c9e30192af7e60dd785438585e4c05cbb56ea353b636feb5bce1c94b7dc8622cea22deab9760c2563f15b26157a088d61fad1
SSDEEP

3072:1/xTcVKw4RpaXoamU2ztacchHA6ylQMMve70+VY9kWG8H6Y62a:1pe5ZXisccpgl4mCyGH6Y6l

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4932	4ca30b18132145bea2996fcf79a2f9574eac0283e86b4d69ef0ace3c0167bb1e.exe

Executes dropped EXE 1 IoCs

pid	Process
4932	4ca30b18132145bea2996fcf79a2f9574eac0283e86b4d69ef0ace3c0167bb1e.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
3108	6024	WerFault.exe	81
6040	4932	WerFault.exe
5580	4932	WerFault.exe	88
5424	4932	WerFault.exe	88
116	4932	WerFault.exe	88
1540	4932	WerFault.exe	88
4888	4932	WerFault.exe	88

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
6024	4ca30b18132145bea2996fcf79a2f9574eac0283e86b4d69ef0ace3c0167bb1e.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4932	4ca30b18132145bea2996fcf79a2f9574eac0283e86b4d69ef0ace3c0167bb1e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6024 wrote to memory of 4932	6024	4ca30b18132145bea2996fcf79a2f9574eac0283e86b4d69ef0ace3c0167bb1e.exe	88
PID 6024 wrote to memory of 4932	6024	4ca30b18132145bea2996fcf79a2f9574eac0283e86b4d69ef0ace3c0167bb1e.exe	88
PID 6024 wrote to memory of 4932	6024	4ca30b18132145bea2996fcf79a2f9574eac0283e86b4d69ef0ace3c0167bb1e.exe	88

C:\Users\Admin\AppData\Local\Temp\4ca30b18132145bea2996fcf79a2f9574eac0283e86b4d69ef0ace3c0167bb1e.exe
"C:\Users\Admin\AppData\Local\Temp\4ca30b18132145bea2996fcf79a2f9574eac0283e86b4d69ef0ace3c0167bb1e.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:6024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6024 -s 356
  2⤵
  - Program crash
  PID:3108
- C:\Users\Admin\AppData\Local\Temp\4ca30b18132145bea2996fcf79a2f9574eac0283e86b4d69ef0ace3c0167bb1e.exe
  C:\Users\Admin\AppData\Local\Temp\4ca30b18132145bea2996fcf79a2f9574eac0283e86b4d69ef0ace3c0167bb1e.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 352
    3⤵
    - Program crash
    PID:6040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 768
    3⤵
    - Program crash
    PID:5580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 772
    3⤵
    - Program crash
    PID:5424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 768
    3⤵
    - Program crash
    PID:116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 808
    3⤵
    - Program crash
    PID:1540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 792
    3⤵
    - Program crash
    PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6024 -ip 6024
1⤵
PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4932 -ip 4932
1⤵
PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4932 -ip 4932
1⤵
PID:1220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4932 -ip 4932
1⤵
PID:5604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4932 -ip 4932
1⤵
PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4932 -ip 4932
1⤵
PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4932 -ip 4932
1⤵
PID:4400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4ca30b18132145bea2996fcf79a2f9574eac0283e86b4d69ef0ace3c0167bb1e.exe

Filesize
197KB

MD5
ebb9688229c6a40224c2a718364b2761

SHA1
9e542c60749450a93e5d820d0e45f7ae7a7150a2

SHA256
27e78dfc38f30c05f6c21e341cb962de3683fd9658ce8d71a0f15d2a2ee4a939

SHA512
0e8063a992dc08eb60e59469fdd53af00b8c90bfc90515f4cd81ab2b0eec13bfeacd62257a879e4dbeab4b8456c0f1fcc65850d90047a584fbcc6a5da401de5c

Download Submit
memory/4932-7-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4932-8-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4932-13-0x00000000001B0000-0x00000000001EF000-memory.dmp

Filesize
252KB

Download
memory/4932-14-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/6024-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/6024-6-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download