d17d3e14273d6d7903c52101fe706bfa5f2e59aa6072e7c106b73b516c8f8722

Analysis

max time kernel
142s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 02:44

Target

d17d3e14273d6d7903c52101fe706bfa5f2e59aa6072e7c106b73b516c8f8722.exe
Size

1.6MB
MD5

1fefbfe4a877b4018eac17b5acfd2608
SHA1

6bd2dcd662392efaf566e6cc4c8c246278337eae
SHA256

d17d3e14273d6d7903c52101fe706bfa5f2e59aa6072e7c106b73b516c8f8722
SHA512

c358ec55d8f968fc281119bf4cbbef93bd1508da9017a0146a8748a990b4516049cc2cb5c1b7abb9e32e6e1d44cce729569262a37159ab7270f2077d09bcd082
SSDEEP

24576:E5ibHPQHZHCtCO/CpCaxxCV7sZ5/pM4dma4EM4dmv5BTqV0EM4dmv5Bc:8iT4HZbxIgZVa4L4j425Iyj425S

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4468	d17d3e14273d6d7903c52101fe706bfa5f2e59aa6072e7c106b73b516c8f8722.exe

Executes dropped EXE 1 IoCs

pid	Process
4468	d17d3e14273d6d7903c52101fe706bfa5f2e59aa6072e7c106b73b516c8f8722.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4676	4616	WerFault.exe	90
1464	4468	WerFault.exe	94
312	4468	WerFault.exe	94

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4616	d17d3e14273d6d7903c52101fe706bfa5f2e59aa6072e7c106b73b516c8f8722.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 4468	4616	d17d3e14273d6d7903c52101fe706bfa5f2e59aa6072e7c106b73b516c8f8722.exe	94
PID 4616 wrote to memory of 4468	4616	d17d3e14273d6d7903c52101fe706bfa5f2e59aa6072e7c106b73b516c8f8722.exe	94
PID 4616 wrote to memory of 4468	4616	d17d3e14273d6d7903c52101fe706bfa5f2e59aa6072e7c106b73b516c8f8722.exe	94

C:\Users\Admin\AppData\Local\Temp\d17d3e14273d6d7903c52101fe706bfa5f2e59aa6072e7c106b73b516c8f8722.exe
"C:\Users\Admin\AppData\Local\Temp\d17d3e14273d6d7903c52101fe706bfa5f2e59aa6072e7c106b73b516c8f8722.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 384
  2⤵
  - Program crash
  PID:4676
- C:\Users\Admin\AppData\Local\Temp\d17d3e14273d6d7903c52101fe706bfa5f2e59aa6072e7c106b73b516c8f8722.exe
  C:\Users\Admin\AppData\Local\Temp\d17d3e14273d6d7903c52101fe706bfa5f2e59aa6072e7c106b73b516c8f8722.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 352
    3⤵
    - Program crash
    PID:1464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 392
    3⤵
    - Program crash
    PID:312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4616 -ip 4616
1⤵
PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4468 -ip 4468
1⤵
PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4468 -ip 4468
1⤵
PID:2076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:4060

C:\Users\Admin\AppData\Local\Temp\d17d3e14273d6d7903c52101fe706bfa5f2e59aa6072e7c106b73b516c8f8722.exe

Filesize
1.6MB

MD5
5955eb774ffd82684909bdfc3be54b7c

SHA1
343f44d2d417e11042f4c71a3cf81063c9ef4a7a

SHA256
403cc06d509575ffc8c2899712de570248da2077cd98a0429af10d8e370210ad

SHA512
44dfe49b0a5cdf6a8ff29103281fcff30de9dbf1a7836e33be2f5d8f09304a132c81e4327472d652707c01d613083561f7ab97df2063976c2478be1a4d97f1b2

Download Submit
memory/4468-8-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/4468-10-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/4468-11-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/4616-0-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/4616-7-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download