816678f27a605539befc4304ad9d82a8b95a6292180616de67b5861e0cd0a44e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 03:27

Target

Q210203W.exe
Size

220KB
MD5

fa56b6d31bcdbe7a969c432099c28611
SHA1

7ff0f279a8ed6759ea3344f484cd82d174896c20
SHA256

2b9cc84b89000fae34b2808cfbc40c76a0f9f40f02aad848c3789b2fc347ccf0
SHA512

25eeb37a943edd0cb193673644e1f60bebbf26d85951a4802c82bc56dc85dc524ec82c8d725edaf1285edf998fc193613ba8522cb649bf0ba1cc9c8edbf366eb
SSDEEP

6144:4qjIp2Tdl/KdPGf8EMTXZ8YVDcjCCKopU+mQfVYKt:1u2dYRXZ8QHIC+mQr

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
5024	Q210203W.exe
5024	Q210203W.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5012	5024	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 3028	5024	Q210203W.exe	86
PID 5024 wrote to memory of 3028	5024	Q210203W.exe	86
PID 5024 wrote to memory of 3028	5024	Q210203W.exe	86

C:\Users\Admin\AppData\Local\Temp\Q210203W.exe
"C:\Users\Admin\AppData\Local\Temp\Q210203W.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Users\Admin\AppData\Local\Temp\Q210203W.exe
  "C:\Users\Admin\AppData\Local\Temp\Q210203W.exe"
  2⤵
  PID:3028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 1004
  2⤵
  - Program crash
  PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5024 -ip 5024
1⤵
PID:3324

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Isdjek.dll

Filesize
10KB

MD5
736d1bc5cb5ad0af70d6a94b768f2803

SHA1
5cd2f1e890d3f493dc61c05130c8ca2979ee0bb4

SHA256
1bba6e6e13f028e67d529d52e3614b607536f718b5d8e0aa6cd98f1aa15101b7

SHA512
909e33ffdbbe3c6f797e3eea14d5722addbbe3e5c9cb085dc2edbd8d69942de3d6dd58a57f5476a5e255b80b50869a516814b1b9791c388a2fb7749ca246cbff

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc98A7.tmp\System.dll

Filesize
11KB

MD5
fccff8cb7a1067e23fd2e2b63971a8e1

SHA1
30e2a9e137c1223a78a0f7b0bf96a1c361976d91

SHA256
6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

SHA512
f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

Download Submit
memory/5024-10-0x0000000074D20000-0x0000000074D26000-memory.dmp

Filesize
24KB

Download
memory/5024-11-0x0000000074D20000-0x0000000074D26000-memory.dmp

Filesize
24KB

Download