e67e1deb3ebfdd567056094221586fbabb9bf6887a6e0bf9d8ca1ad482dd36c2

Analysis

max time kernel
140s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 04:46

Target

e67e1deb3ebfdd567056094221586fbabb9bf6887a6e0bf9d8ca1ad482dd36c2.exe
Size

274KB
MD5

14b8ad0fdb8d25560cabd68c0268454a
SHA1

413205624897358929a0c76bbf73f476e17abd23
SHA256

e67e1deb3ebfdd567056094221586fbabb9bf6887a6e0bf9d8ca1ad482dd36c2
SHA512

6efbee4e9fa6955a082655a868f31a12a098bd57ab0e327970bb2696b160a8efb33a7588225f0bb10cdf9e3e3822ba862edfd99bf4753a5a77a696e9a93db326
SSDEEP

6144:8y4/tkMcYcLBwOHcdEI/Wqv6LIzTqUw9OZ7qA0xfsLP:ymmvDzGB9OZ7qAufm

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1092	e67e1deb3ebfdd567056094221586fbabb9bf6887a6e0bf9d8ca1ad482dd36c2.exe

Executes dropped EXE 1 IoCs

pid	Process
1092	e67e1deb3ebfdd567056094221586fbabb9bf6887a6e0bf9d8ca1ad482dd36c2.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4408	2512	WerFault.exe	82
1528	1092	WerFault.exe	90
4544	1092	WerFault.exe	90

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2512	e67e1deb3ebfdd567056094221586fbabb9bf6887a6e0bf9d8ca1ad482dd36c2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1092	2512	e67e1deb3ebfdd567056094221586fbabb9bf6887a6e0bf9d8ca1ad482dd36c2.exe	90
PID 2512 wrote to memory of 1092	2512	e67e1deb3ebfdd567056094221586fbabb9bf6887a6e0bf9d8ca1ad482dd36c2.exe	90
PID 2512 wrote to memory of 1092	2512	e67e1deb3ebfdd567056094221586fbabb9bf6887a6e0bf9d8ca1ad482dd36c2.exe	90

C:\Users\Admin\AppData\Local\Temp\e67e1deb3ebfdd567056094221586fbabb9bf6887a6e0bf9d8ca1ad482dd36c2.exe
"C:\Users\Admin\AppData\Local\Temp\e67e1deb3ebfdd567056094221586fbabb9bf6887a6e0bf9d8ca1ad482dd36c2.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 396
  2⤵
  - Program crash
  PID:4408
- C:\Users\Admin\AppData\Local\Temp\e67e1deb3ebfdd567056094221586fbabb9bf6887a6e0bf9d8ca1ad482dd36c2.exe
  C:\Users\Admin\AppData\Local\Temp\e67e1deb3ebfdd567056094221586fbabb9bf6887a6e0bf9d8ca1ad482dd36c2.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 364
    3⤵
    - Program crash
    PID:1528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 164
    3⤵
    - Program crash
    PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2512 -ip 2512
1⤵
PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1092 -ip 1092
1⤵
PID:2400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1092 -ip 1092
1⤵
PID:556

C:\Users\Admin\AppData\Local\Temp\e67e1deb3ebfdd567056094221586fbabb9bf6887a6e0bf9d8ca1ad482dd36c2.exe

Filesize
274KB

MD5
8c0d2badf1369b0f8c8ad5605b15805d

SHA1
8c52ecaefc0e729043d645f5cf77337734a863ff

SHA256
07c4f8102cf9e41a3686100f49129834083858bfa0a0764c9b1fbde84ef111d5

SHA512
50106444e5ff74f649dd314a125c88265aca2323cd8811963581d9b999e5be2cedcf088c70d5f6be8e6db1d85fdd81ff1e1062ebf7e1e11f828ae8b639ef6a5f

Download Submit
memory/1092-8-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1092-10-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2512-0-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2512-7-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download