0b4ca2ac189d667bf99564ccf369108e8e9bf337092b82137f1cd583c5dbffc1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 03:51

Target

282f11ac525604080082dc72d8552f00N.exe
Size

220KB
MD5

282f11ac525604080082dc72d8552f00
SHA1

388a4904e1fc720568a0ee5905eabe8d3ff921f1
SHA256

0b4ca2ac189d667bf99564ccf369108e8e9bf337092b82137f1cd583c5dbffc1
SHA512

dc9c8c685ff8939454d700dd5c4a828bffee749def15b020a261b80f3bac358645264f3d5b68aa23f5a3fea0e532fbf1d18d90ada797f2f116a65a3f93552499
SSDEEP

6144:ryPxFZ2oo4+SarhkX3ZrVrNBVU5aI/ui1qZYCt:rEEPrkZBrN7U5aI/OZYCt

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2536	282f11ac525604080082dc72d8552f00N.exe

Executes dropped EXE 1 IoCs

pid	Process
2536	282f11ac525604080082dc72d8552f00N.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2660	2432	WerFault.exe	81
2188	2536	WerFault.exe	89

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2432	282f11ac525604080082dc72d8552f00N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2536	282f11ac525604080082dc72d8552f00N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2536	2432	282f11ac525604080082dc72d8552f00N.exe	89
PID 2432 wrote to memory of 2536	2432	282f11ac525604080082dc72d8552f00N.exe	89
PID 2432 wrote to memory of 2536	2432	282f11ac525604080082dc72d8552f00N.exe	89

C:\Users\Admin\AppData\Local\Temp\282f11ac525604080082dc72d8552f00N.exe
"C:\Users\Admin\AppData\Local\Temp\282f11ac525604080082dc72d8552f00N.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 396
  2⤵
  - Program crash
  PID:2660
- C:\Users\Admin\AppData\Local\Temp\282f11ac525604080082dc72d8552f00N.exe
  C:\Users\Admin\AppData\Local\Temp\282f11ac525604080082dc72d8552f00N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 372
    3⤵
    - Program crash
    PID:2188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2432 -ip 2432
1⤵
PID:2416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2536 -ip 2536
1⤵
PID:4344

C:\Users\Admin\AppData\Local\Temp\282f11ac525604080082dc72d8552f00N.exe

Filesize
220KB

MD5
7b90bccf7270a8c205c936c677feec86

SHA1
952a12dc82efcb4370be1bf5022cf76137f0951a

SHA256
dfbe9365009efcaca577874b19db343a4bdf26fb8700220afd2ab1aace1c8d69

SHA512
686602a98a472d864d3a1df3f10b404bf0b9ce01227e1370733df54a8ea9dd2867dad0fc78652666e27ab57f623ac5015bae7a1d89bd287f1b9bf1de166a1920

Download Submit
memory/2432-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2432-6-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2536-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2536-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2536-13-0x00000000014B0000-0x00000000014F1000-memory.dmp

Filesize
260KB

Download
memory/2536-14-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download