a6e1621136f6506065d5f329b14c34ff2cee8553383eb15a84b908aa448cc023

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 01:14

Target

a6e1621136f6506065d5f329b14c34ff2cee8553383eb15a84b908aa448cc023.exe
Size

656KB
MD5

c00a124130c358a9769fee170ca5eb41
SHA1

0c5e5d27e88f667b924757a0f5e1ebcf9d375825
SHA256

a6e1621136f6506065d5f329b14c34ff2cee8553383eb15a84b908aa448cc023
SHA512

983ec421d0a762194ad8c0700990f4997d9b494961f61e5cd077855784ac6ce53716b733426a6588c81851eea4398c589065263b81e5c1fc9b2d6c5d683002e0
SSDEEP

12288:l6SaY5OtiNT70Z69e9tfzVQ5zCD4VZRDGWF1m3aYhOA6eXVQ5zCD8:lhOtxZ6k9tfzVQ5zY431CaYAeXVQ5zY8

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4528	a6e1621136f6506065d5f329b14c34ff2cee8553383eb15a84b908aa448cc023.exe

Executes dropped EXE 1 IoCs

pid	Process
4528	a6e1621136f6506065d5f329b14c34ff2cee8553383eb15a84b908aa448cc023.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1936	1540	WerFault.exe	80
2076	4528	WerFault.exe	87

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1540	a6e1621136f6506065d5f329b14c34ff2cee8553383eb15a84b908aa448cc023.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4528	a6e1621136f6506065d5f329b14c34ff2cee8553383eb15a84b908aa448cc023.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 4528	1540	a6e1621136f6506065d5f329b14c34ff2cee8553383eb15a84b908aa448cc023.exe	87
PID 1540 wrote to memory of 4528	1540	a6e1621136f6506065d5f329b14c34ff2cee8553383eb15a84b908aa448cc023.exe	87
PID 1540 wrote to memory of 4528	1540	a6e1621136f6506065d5f329b14c34ff2cee8553383eb15a84b908aa448cc023.exe	87

C:\Users\Admin\AppData\Local\Temp\a6e1621136f6506065d5f329b14c34ff2cee8553383eb15a84b908aa448cc023.exe
"C:\Users\Admin\AppData\Local\Temp\a6e1621136f6506065d5f329b14c34ff2cee8553383eb15a84b908aa448cc023.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 396
  2⤵
  - Program crash
  PID:1936
- C:\Users\Admin\AppData\Local\Temp\a6e1621136f6506065d5f329b14c34ff2cee8553383eb15a84b908aa448cc023.exe
  C:\Users\Admin\AppData\Local\Temp\a6e1621136f6506065d5f329b14c34ff2cee8553383eb15a84b908aa448cc023.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 376
    3⤵
    - Program crash
    PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1540 -ip 1540
1⤵
PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4528 -ip 4528
1⤵
PID:700

C:\Users\Admin\AppData\Local\Temp\a6e1621136f6506065d5f329b14c34ff2cee8553383eb15a84b908aa448cc023.exe

Filesize
656KB

MD5
04c379b394bfb7fceeab60663a20504d

SHA1
34006f8645a4433e0f4a3a3bb1f2e77727b729b4

SHA256
3f486134309c527303afb39c929d8faeeae6b1df418b44d49341555450368124

SHA512
c9f8457e214850d75c69a46a02070e752fe88a3e044b91cfdaf4929e7633d9d12c4d22a949beea1ff58b8f6a5e79f49b5a7b95a993bd9c8cb488f559e38bd03e

Download Submit
memory/1540-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1540-6-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4528-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4528-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4528-13-0x00000000014C0000-0x0000000001500000-memory.dmp

Filesize
256KB

Download