c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 03:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe
Size

320KB
MD5

2366207c90efdb4e06c27d1b0be6b0fa
SHA1

23b0d1c16bc54d813416e2fa076fe8da9308d194
SHA256

c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7
SHA512

875b32bbef3045cec60e872cb820b4e7bdfaeb070f5fdad9a22457cf557edfb6e028245a80e793629ce14f6cdaca631fab561ba395ca7d66dc597fff87437712
SSDEEP

6144:5RMvewKVx8QS4U7zBE2wZliNIDEqZK0W7cyqCxSngmMBqfycuPbUl0i5w:5RoeNKQ07AZMwEqZQ0npM4dl0b

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4780	c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe

Executes dropped EXE 1 IoCs

pid	Process
4780	c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
2276	4968	WerFault.exe	80
3052	4780	WerFault.exe	84
4552	4780	WerFault.exe	84
4996	4780	WerFault.exe	84
4504	4780	WerFault.exe	84
1580	4780	WerFault.exe	84
4880	4780	WerFault.exe	84

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4968	c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4780	c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 4780	4968	c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe	84
PID 4968 wrote to memory of 4780	4968	c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe	84
PID 4968 wrote to memory of 4780	4968	c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe	84

C:\Users\Admin\AppData\Local\Temp\c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe
"C:\Users\Admin\AppData\Local\Temp\c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 384
  2⤵
  - Program crash
  PID:2276
- C:\Users\Admin\AppData\Local\Temp\c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe
  C:\Users\Admin\AppData\Local\Temp\c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 360
    3⤵
    - Program crash
    PID:3052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 768
    3⤵
    - Program crash
    PID:4552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 812
    3⤵
    - Program crash
    PID:4996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 820
    3⤵
    - Program crash
    PID:4504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 556
    3⤵
    - Program crash
    PID:1580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 824
    3⤵
    - Program crash
    PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4968 -ip 4968
1⤵
PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4780 -ip 4780
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4780 -ip 4780
1⤵
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4780 -ip 4780
1⤵
PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4780 -ip 4780
1⤵
PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4780 -ip 4780
1⤵
PID:2844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4780 -ip 4780
1⤵
PID:4304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe

Filesize
320KB

MD5
e86965df63e5dfebf68b27e9c3407d3b

SHA1
d163c397cdfe62dc84352f16fb25d0efcfa53eac

SHA256
c3c180baf9d2287a0fcdb00692b7c507fedd2bf2a36f7271223d4643c470008e

SHA512
82fff66b3a75041acfa572124544218fbcafc486af793bf04e398558dd8241b782aa6de5d20c5a99e1331aee45a85d57ae6030036f149197edeeebb5aba6efa9

Download Submit
memory/4780-8-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4780-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4780-14-0x00000000014D0000-0x0000000001508000-memory.dmp

Filesize
224KB

Download
memory/4968-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4968-7-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download