3026861ef6d4ea517aee88fe1f1d6a6238c789b2966dd64d5b4a89681fdbf353

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 20:12

Target

3026861ef6d4ea517aee88fe1f1d6a6238c789b2966dd64d5b4a89681fdbf353.exe
Size

668KB
MD5

32a6147ce17bd2c47409fc62fca7790b
SHA1

4cfd3232a2c3cc55813f131375d27570ec29b9c8
SHA256

3026861ef6d4ea517aee88fe1f1d6a6238c789b2966dd64d5b4a89681fdbf353
SHA512

87705d4ebc9fa8f90997cb3c9e06e242f49544cf1df7f1aa1178c25036649c43eec575fbf5fd489a726e8d97e7b65912d3ac74a7676c6edc6ee9e1b81c6193f5
SSDEEP

12288:6ZySFPajz65yfRlJDHUVQ5zCN2j6FB5WMlL143VQ5zCSjdgEi0kXz:68Slaje5y5lJDHUVQ5zg2mblLO3VQ5zC

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1648	3026861ef6d4ea517aee88fe1f1d6a6238c789b2966dd64d5b4a89681fdbf353.exe

Executes dropped EXE 1 IoCs

pid	Process
1648	3026861ef6d4ea517aee88fe1f1d6a6238c789b2966dd64d5b4a89681fdbf353.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3868	3528	WerFault.exe	81
1804	1648	WerFault.exe	89

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3528	3026861ef6d4ea517aee88fe1f1d6a6238c789b2966dd64d5b4a89681fdbf353.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1648	3026861ef6d4ea517aee88fe1f1d6a6238c789b2966dd64d5b4a89681fdbf353.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 1648	3528	3026861ef6d4ea517aee88fe1f1d6a6238c789b2966dd64d5b4a89681fdbf353.exe	89
PID 3528 wrote to memory of 1648	3528	3026861ef6d4ea517aee88fe1f1d6a6238c789b2966dd64d5b4a89681fdbf353.exe	89
PID 3528 wrote to memory of 1648	3528	3026861ef6d4ea517aee88fe1f1d6a6238c789b2966dd64d5b4a89681fdbf353.exe	89

C:\Users\Admin\AppData\Local\Temp\3026861ef6d4ea517aee88fe1f1d6a6238c789b2966dd64d5b4a89681fdbf353.exe
"C:\Users\Admin\AppData\Local\Temp\3026861ef6d4ea517aee88fe1f1d6a6238c789b2966dd64d5b4a89681fdbf353.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 396
  2⤵
  - Program crash
  PID:3868
- C:\Users\Admin\AppData\Local\Temp\3026861ef6d4ea517aee88fe1f1d6a6238c789b2966dd64d5b4a89681fdbf353.exe
  C:\Users\Admin\AppData\Local\Temp\3026861ef6d4ea517aee88fe1f1d6a6238c789b2966dd64d5b4a89681fdbf353.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 364
    3⤵
    - Program crash
    PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3528 -ip 3528
1⤵
PID:2188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1648 -ip 1648
1⤵
PID:2628

C:\Users\Admin\AppData\Local\Temp\3026861ef6d4ea517aee88fe1f1d6a6238c789b2966dd64d5b4a89681fdbf353.exe

Filesize
668KB

MD5
060b2b866857916d3e5dbd413525abae

SHA1
291be66a92d2718e944d67e6113962c691fc36ea

SHA256
81d0f1afca2c613ed1d48ede3ac158473a00c52b5337f0e27855f725341fb8d0

SHA512
d8db9ea0147f983a3c029b9893c88b68c1218a6626d8be30defa17a3b68581436adb605cf09fecd3220f874995873a65e6cfddc6dd8e7c4ad15518dcdf5c1c7e

Download Submit
memory/1648-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1648-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1648-13-0x0000000001500000-0x0000000001541000-memory.dmp

Filesize
260KB

Download
memory/3528-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3528-6-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download