4012fc8a18143b705b5deca44947284bff86b164ba52e7e9edb64ea7aee829f5

Analysis

max time kernel
93s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16-06-2024 20:34

Target

4012fc8a18143b705b5deca44947284bff86b164ba52e7e9edb64ea7aee829f5.exe
Size

233KB
MD5

7be53df8c2d6985e2902571cfebc964a
SHA1

78710d4ca37f2af76c8a3cb566a39cfaccf94c8b
SHA256

4012fc8a18143b705b5deca44947284bff86b164ba52e7e9edb64ea7aee829f5
SHA512

30c8cd4c2d0457eadfed7b232f19ca8f2ec7ff1ab519996aa8db5573dc71945550f8ccc4f0ab333cbd3064b93e23d64237587cb597ce04365c3045ea6155848d
SSDEEP

3072:H+Qejib9qog4aV6drrAfLlSwFNtJfAO2wVFnO1nPLG3bzJYjuj9pexeG7KfSaJC:sibsol07SwNrfCw3nO1PyHejKhNJC

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3972	4012fc8a18143b705b5deca44947284bff86b164ba52e7e9edb64ea7aee829f5.exe

Executes dropped EXE 1 IoCs

pid	Process
3972	4012fc8a18143b705b5deca44947284bff86b164ba52e7e9edb64ea7aee829f5.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
676	4236	WerFault.exe	81
636	3972	WerFault.exe	90

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4236	4012fc8a18143b705b5deca44947284bff86b164ba52e7e9edb64ea7aee829f5.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3972	4012fc8a18143b705b5deca44947284bff86b164ba52e7e9edb64ea7aee829f5.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 3972	4236	4012fc8a18143b705b5deca44947284bff86b164ba52e7e9edb64ea7aee829f5.exe	90
PID 4236 wrote to memory of 3972	4236	4012fc8a18143b705b5deca44947284bff86b164ba52e7e9edb64ea7aee829f5.exe	90
PID 4236 wrote to memory of 3972	4236	4012fc8a18143b705b5deca44947284bff86b164ba52e7e9edb64ea7aee829f5.exe	90

C:\Users\Admin\AppData\Local\Temp\4012fc8a18143b705b5deca44947284bff86b164ba52e7e9edb64ea7aee829f5.exe
"C:\Users\Admin\AppData\Local\Temp\4012fc8a18143b705b5deca44947284bff86b164ba52e7e9edb64ea7aee829f5.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 396
  2⤵
  - Program crash
  PID:676
- C:\Users\Admin\AppData\Local\Temp\4012fc8a18143b705b5deca44947284bff86b164ba52e7e9edb64ea7aee829f5.exe
  C:\Users\Admin\AppData\Local\Temp\4012fc8a18143b705b5deca44947284bff86b164ba52e7e9edb64ea7aee829f5.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 364
    3⤵
    - Program crash
    PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4236 -ip 4236
1⤵
PID:932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3972 -ip 3972
1⤵
PID:2256

C:\Users\Admin\AppData\Local\Temp\4012fc8a18143b705b5deca44947284bff86b164ba52e7e9edb64ea7aee829f5.exe

Filesize
233KB

MD5
303352a34dac0af50f943d4eadb6db64

SHA1
d88bdfdc668cbcdee6b2b4369f76fd7777ea63c6

SHA256
a4037d151bc47cb732f94580ff0c331b810eb3f7188b3e61cd760d645d7e5384

SHA512
bb9f20239ac7a6db7ff643e5aa134ddc0522ed8545141c3a3557d26f83576db4456ad1b8f5b86861e9533a37cec38ca4defc3231342f4b24694d5f782168a3ed

Download Submit
memory/3972-7-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3972-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3972-13-0x0000000004DB0000-0x0000000004DEF000-memory.dmp

Filesize
252KB

Download
memory/4236-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4236-5-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download