24973e8808c205b7761b5b468df343b1826c6c339e66e5661103a42632aa0dbb

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/06/2024, 01:06

Target

24973e8808c205b7761b5b468df343b1826c6c339e66e5661103a42632aa0dbb.exe
Size

4.5MB
MD5

116fe2b909ecbd566b0ace44a9eea180
SHA1

c5266a67ba49645aca4b70a9a84047041629bac8
SHA256

24973e8808c205b7761b5b468df343b1826c6c339e66e5661103a42632aa0dbb
SHA512

0421a7638dca2eec5bbcffd45c9de2fea4235779d506f51d252123e5135e7355b19bf254186e785554c71c82864bcb54f42a3a2aa3a0835560081238c743e894
SSDEEP

98304:EAjGEaI6o/bPLge0Vgu0AqN3u37HmKam/BivHcjvUB:ky6GjLgnNGN3u3qKakBwHcg

Score

9^/10

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/memory/4548-4-0x0000000000400000-0x0000000000B70000-memory.dmp	UPX
behavioral2/memory/4548-5-0x0000000000400000-0x0000000000B70000-memory.dmp	UPX
behavioral2/memory/4548-6-0x0000000000400000-0x0000000000B70000-memory.dmp	UPX

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4608	sc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2712	4548	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4548	24973e8808c205b7761b5b468df343b1826c6c339e66e5661103a42632aa0dbb.exe
4548	24973e8808c205b7761b5b468df343b1826c6c339e66e5661103a42632aa0dbb.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 4732	4548	24973e8808c205b7761b5b468df343b1826c6c339e66e5661103a42632aa0dbb.exe	81
PID 4548 wrote to memory of 4732	4548	24973e8808c205b7761b5b468df343b1826c6c339e66e5661103a42632aa0dbb.exe	81
PID 4548 wrote to memory of 4732	4548	24973e8808c205b7761b5b468df343b1826c6c339e66e5661103a42632aa0dbb.exe	81
PID 4732 wrote to memory of 4608	4732	cmd.exe	83
PID 4732 wrote to memory of 4608	4732	cmd.exe	83
PID 4732 wrote to memory of 4608	4732	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\24973e8808c205b7761b5b468df343b1826c6c339e66e5661103a42632aa0dbb.exe
"C:\Users\Admin\AppData\Local\Temp\24973e8808c205b7761b5b468df343b1826c6c339e66e5661103a42632aa0dbb.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config "UxSms" start= demand
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\SysWOW64\sc.exe
    sc config "UxSms" start= demand
    3⤵
    - Launches sc.exe
    PID:4608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 528
  2⤵
  - Program crash
  PID:2712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4548 -ip 4548
1⤵
PID:5016

memory/4548-1-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Filesize
4KB

Download
memory/4548-4-0x0000000000400000-0x0000000000B70000-memory.dmp

Filesize
7.4MB

Download
memory/4548-0-0x00000000004A2000-0x00000000006E9000-memory.dmp

Filesize
2.3MB

Download
memory/4548-5-0x0000000000400000-0x0000000000B70000-memory.dmp

Filesize
7.4MB

Download
memory/4548-6-0x0000000000400000-0x0000000000B70000-memory.dmp

Filesize
7.4MB

Download
memory/4548-7-0x00000000004A2000-0x00000000006E9000-memory.dmp

Filesize
2.3MB

Download