d6792bbdbdca978d8ea26079cc5e22325bedc0e8242d02c6d9072a765359e3bd

Analysis

max time kernel
126s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 04:14

Target

d6792bbdbdca978d8ea26079cc5e22325bedc0e8242d02c6d9072a765359e3bd.exe
Size

416KB
MD5

36cbe7b229e6cb04f48bd68288e1200f
SHA1

51f47baeb0f0771e436befd9ec905403a4d9fe24
SHA256

d6792bbdbdca978d8ea26079cc5e22325bedc0e8242d02c6d9072a765359e3bd
SHA512

9d66b182621c52023c418ad76e91a9300d004f6eabe9c814ee12f6b9fd59d4ba638234c5755bb7740f7b3107e42b897f4b9cdd7e15497757c8ac69e43f0c790c
SSDEEP

12288:ScMiJGzgXzCwakjYeF4/SiotZwJRa2vLPjfx5m84prF:tlOgDCwakjYeF4/SiotZwJRa2vLPjfxo

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2372	d6792bbdbdca978d8ea26079cc5e22325bedc0e8242d02c6d9072a765359e3bd.exe

Executes dropped EXE 1 IoCs

pid	Process
2372	d6792bbdbdca978d8ea26079cc5e22325bedc0e8242d02c6d9072a765359e3bd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2528	1408	WerFault.exe	88
3956	2372	WerFault.exe	93

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1408	d6792bbdbdca978d8ea26079cc5e22325bedc0e8242d02c6d9072a765359e3bd.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2372	d6792bbdbdca978d8ea26079cc5e22325bedc0e8242d02c6d9072a765359e3bd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 2372	1408	d6792bbdbdca978d8ea26079cc5e22325bedc0e8242d02c6d9072a765359e3bd.exe	93
PID 1408 wrote to memory of 2372	1408	d6792bbdbdca978d8ea26079cc5e22325bedc0e8242d02c6d9072a765359e3bd.exe	93
PID 1408 wrote to memory of 2372	1408	d6792bbdbdca978d8ea26079cc5e22325bedc0e8242d02c6d9072a765359e3bd.exe	93

C:\Users\Admin\AppData\Local\Temp\d6792bbdbdca978d8ea26079cc5e22325bedc0e8242d02c6d9072a765359e3bd.exe
"C:\Users\Admin\AppData\Local\Temp\d6792bbdbdca978d8ea26079cc5e22325bedc0e8242d02c6d9072a765359e3bd.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 396
  2⤵
  - Program crash
  PID:2528
- C:\Users\Admin\AppData\Local\Temp\d6792bbdbdca978d8ea26079cc5e22325bedc0e8242d02c6d9072a765359e3bd.exe
  C:\Users\Admin\AppData\Local\Temp\d6792bbdbdca978d8ea26079cc5e22325bedc0e8242d02c6d9072a765359e3bd.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 372
    3⤵
    - Program crash
    PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1408 -ip 1408
1⤵
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2372 -ip 2372
1⤵
PID:748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:8
1⤵
PID:5056

C:\Users\Admin\AppData\Local\Temp\d6792bbdbdca978d8ea26079cc5e22325bedc0e8242d02c6d9072a765359e3bd.exe

Filesize
416KB

MD5
9e5de1c7c65c6ca7198d51fd7797106c

SHA1
218a99cfd855196840df3c13ba0654fafc033c0d

SHA256
c4211e20aae46d70ee410ec362ec64c3f8d21feb19dff3951d13da2f97bc21d3

SHA512
bfe43672c14ea9adc42c5795b73c35ac6f1215a244a9e40b3a1cefbdf19aa7afc1dfcb86e5022731c8035594ac045ac2bc4e141baba8dc35565400b9e7a68030

Download Submit
memory/1408-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1408-6-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2372-7-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2372-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2372-13-0x00000000014C0000-0x00000000014F9000-memory.dmp

Filesize
228KB

Download