7ad794d43d94a77c35e50f11ae3a9a2e74cbf78038e71d428f6966cc026ee3a7

Analysis

max time kernel
141s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 00:13

Target

7ad794d43d94a77c35e50f11ae3a9a2e74cbf78038e71d428f6966cc026ee3a7.exe
Size

190KB
MD5

8b572bec3f6736ed4f6825743a15d570
SHA1

10b42437d15a3b85b22291e42bbbc6f33e24776c
SHA256

7ad794d43d94a77c35e50f11ae3a9a2e74cbf78038e71d428f6966cc026ee3a7
SHA512

9abe3aa17d408bc5f0ad3b6e41884ff4abefd8be11986dd09dd7e1e59cf055bf4a6a5e048ef42816aa204f224151f75313cd17a8f3d13c1bd0b8f37306f5abf2
SSDEEP

3072:QmdzvUPAyoVFtniwTenBriG3XRfaXy7Ve7d9/c0O73MJLWBbR6mXx5RdETkq:1dzvxiTOaX0Xy7Vex9/c0ODa4nEI

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4372	7ad794d43d94a77c35e50f11ae3a9a2e74cbf78038e71d428f6966cc026ee3a7.exe

Executes dropped EXE 1 IoCs

pid	Process
4372	7ad794d43d94a77c35e50f11ae3a9a2e74cbf78038e71d428f6966cc026ee3a7.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2248	2036	WerFault.exe	82
4672	4372	WerFault.exe
2820	4372	WerFault.exe	87

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2036	7ad794d43d94a77c35e50f11ae3a9a2e74cbf78038e71d428f6966cc026ee3a7.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4372	7ad794d43d94a77c35e50f11ae3a9a2e74cbf78038e71d428f6966cc026ee3a7.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 4372	2036	7ad794d43d94a77c35e50f11ae3a9a2e74cbf78038e71d428f6966cc026ee3a7.exe	87
PID 2036 wrote to memory of 4372	2036	7ad794d43d94a77c35e50f11ae3a9a2e74cbf78038e71d428f6966cc026ee3a7.exe	87
PID 2036 wrote to memory of 4372	2036	7ad794d43d94a77c35e50f11ae3a9a2e74cbf78038e71d428f6966cc026ee3a7.exe	87

C:\Users\Admin\AppData\Local\Temp\7ad794d43d94a77c35e50f11ae3a9a2e74cbf78038e71d428f6966cc026ee3a7.exe
"C:\Users\Admin\AppData\Local\Temp\7ad794d43d94a77c35e50f11ae3a9a2e74cbf78038e71d428f6966cc026ee3a7.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 408
  2⤵
  - Program crash
  PID:2248
- C:\Users\Admin\AppData\Local\Temp\7ad794d43d94a77c35e50f11ae3a9a2e74cbf78038e71d428f6966cc026ee3a7.exe
  C:\Users\Admin\AppData\Local\Temp\7ad794d43d94a77c35e50f11ae3a9a2e74cbf78038e71d428f6966cc026ee3a7.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 372
    3⤵
    - Program crash
    PID:4672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 412
    3⤵
    - Program crash
    PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2036 -ip 2036
1⤵
PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4372 -ip 4372
1⤵
PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4372 -ip 4372
1⤵
PID:392

C:\Users\Admin\AppData\Local\Temp\7ad794d43d94a77c35e50f11ae3a9a2e74cbf78038e71d428f6966cc026ee3a7.exe

Filesize
190KB

MD5
0796fcdf34943634c66fdfecaf691b28

SHA1
9eb2d4be5f2e92720289e39314f2acae098ea6b9

SHA256
d7c43f1716eab87e1c2d383d14f8590370fd839f05ccca97e29c2cd96970a1fd

SHA512
74b0c786dee87d6d6ecb7033cd1980c0e0e15dcbf1db3345dd42e17649e35124b51d4cc236ddf0e689bba200b784aa02bca12f4240b606767be3e9a466e2d92c

Download Submit
memory/2036-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2036-7-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4372-8-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4372-14-0x00000000001B0000-0x00000000001E7000-memory.dmp

Filesize
220KB

Download
memory/4372-9-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download