33de60cc86c39e873616e6a3d3864dee2e4ca9af953e0a312b17bcc1f240a850

Analysis

max time kernel
93s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 21:03

Target

33de60cc86c39e873616e6a3d3864dee2e4ca9af953e0a312b17bcc1f240a850.exe
Size

192KB
MD5

0293381e57203dcf3f9e87f08e9edcfa
SHA1

80bf3adafe275b4dda7fb67d9d9fefbf8f8e84e2
SHA256

33de60cc86c39e873616e6a3d3864dee2e4ca9af953e0a312b17bcc1f240a850
SHA512

dd844e56cc50dbb22523a3a87162e364cb367a0d13e24912e1a4bf6e720b63093077bb4872bc5121970732fe01e59f1cd271d8e0fa9d52b1a73ca83791fd228f
SSDEEP

3072:+8ONq+5yRoOZUOPa7NqDOcN7bmGGGvwGcLekTXHIOdb/HRU5ZPcRnYcsqmAPT0qB:+LNq+AWFKSsicxtGnnS2hAqKub4w

Score

7^/10

Deletes itself 1 IoCs

pid	Process
5048	33de60cc86c39e873616e6a3d3864dee2e4ca9af953e0a312b17bcc1f240a850.exe

Executes dropped EXE 1 IoCs

pid	Process
5048	33de60cc86c39e873616e6a3d3864dee2e4ca9af953e0a312b17bcc1f240a850.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2856	4332	WerFault.exe	82
3960	5048	WerFault.exe	90

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4332	33de60cc86c39e873616e6a3d3864dee2e4ca9af953e0a312b17bcc1f240a850.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
5048	33de60cc86c39e873616e6a3d3864dee2e4ca9af953e0a312b17bcc1f240a850.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 5048	4332	33de60cc86c39e873616e6a3d3864dee2e4ca9af953e0a312b17bcc1f240a850.exe	90
PID 4332 wrote to memory of 5048	4332	33de60cc86c39e873616e6a3d3864dee2e4ca9af953e0a312b17bcc1f240a850.exe	90
PID 4332 wrote to memory of 5048	4332	33de60cc86c39e873616e6a3d3864dee2e4ca9af953e0a312b17bcc1f240a850.exe	90

C:\Users\Admin\AppData\Local\Temp\33de60cc86c39e873616e6a3d3864dee2e4ca9af953e0a312b17bcc1f240a850.exe
"C:\Users\Admin\AppData\Local\Temp\33de60cc86c39e873616e6a3d3864dee2e4ca9af953e0a312b17bcc1f240a850.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 396
  2⤵
  - Program crash
  PID:2856
- C:\Users\Admin\AppData\Local\Temp\33de60cc86c39e873616e6a3d3864dee2e4ca9af953e0a312b17bcc1f240a850.exe
  C:\Users\Admin\AppData\Local\Temp\33de60cc86c39e873616e6a3d3864dee2e4ca9af953e0a312b17bcc1f240a850.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:5048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 364
    3⤵
    - Program crash
    PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4332 -ip 4332
1⤵
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5048 -ip 5048
1⤵
PID:1036

C:\Users\Admin\AppData\Local\Temp\33de60cc86c39e873616e6a3d3864dee2e4ca9af953e0a312b17bcc1f240a850.exe

Filesize
192KB

MD5
2c4421968f1b151880ff89623bf956a7

SHA1
7b16c918dc885a98d020a8ca25d3f049139949c9

SHA256
142b03a4e7d669c66cec6130df7ad261ebe51ab466b21d882f2d1da8d1f17cab

SHA512
07cd67021db0364a9b0377c57feca28adf898ec85e68fe36dda1055086131c4a827cb095f4f45f56452ee14cf63823142ffaee71dfab622c5eae5d0f7c5b9c42

Download Submit
memory/4332-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4332-7-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5048-8-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5048-9-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/5048-14-0x00000000014C0000-0x00000000014F7000-memory.dmp

Filesize
220KB

Download