9897d0f4a07c7421cc72de56d8caeac3aad0d49da1a09cf18e19214708270faa

Analysis

max time kernel
101s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 08:58

Target

b5f518730f112d7ce8f9fcd341c3d0e0N.exe
Size

916KB
MD5

b5f518730f112d7ce8f9fcd341c3d0e0
SHA1

0c0c4c240d1cd40f959261065611abcd730a0e5d
SHA256

9897d0f4a07c7421cc72de56d8caeac3aad0d49da1a09cf18e19214708270faa
SHA512

fcf7edfebbac11e440cd9cda7fd726b32dcbff8ede152c1a3756edba1d060cc33851c4f3487c0234879eb476abbaafe13d506e3a3e9c25a0d915ab1bdca2a8f5
SSDEEP

6144:LyXqj99bEn+JRgqiYzJpAHPAZbgeZ7KsgAPW1kEqiqySyJcAwABrxxJa/YES:+XqTgqVp7ZbgeZGLARElqdyxjlDa/ZS

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2300	b5f518730f112d7ce8f9fcd341c3d0e0N.exe

Executes dropped EXE 1 IoCs

pid	Process
2300	b5f518730f112d7ce8f9fcd341c3d0e0N.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4468	2116	WerFault.exe	82
5000	2300	WerFault.exe	90
972	2300	WerFault.exe	90

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2116	b5f518730f112d7ce8f9fcd341c3d0e0N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2300	b5f518730f112d7ce8f9fcd341c3d0e0N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2300	2116	b5f518730f112d7ce8f9fcd341c3d0e0N.exe	90
PID 2116 wrote to memory of 2300	2116	b5f518730f112d7ce8f9fcd341c3d0e0N.exe	90
PID 2116 wrote to memory of 2300	2116	b5f518730f112d7ce8f9fcd341c3d0e0N.exe	90

C:\Users\Admin\AppData\Local\Temp\b5f518730f112d7ce8f9fcd341c3d0e0N.exe
"C:\Users\Admin\AppData\Local\Temp\b5f518730f112d7ce8f9fcd341c3d0e0N.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 352
  2⤵
  - Program crash
  PID:4468
- C:\Users\Admin\AppData\Local\Temp\b5f518730f112d7ce8f9fcd341c3d0e0N.exe
  C:\Users\Admin\AppData\Local\Temp\b5f518730f112d7ce8f9fcd341c3d0e0N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 344
    3⤵
    - Program crash
    PID:5000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 356
    3⤵
    - Program crash
    PID:972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2116 -ip 2116
1⤵
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2300 -ip 2300
1⤵
PID:3672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2300 -ip 2300
1⤵
PID:3952

C:\Users\Admin\AppData\Local\Temp\b5f518730f112d7ce8f9fcd341c3d0e0N.exe

Filesize
916KB

MD5
26207684b6b1fdfd971f5d75f27ad581

SHA1
c2fe1139357b43519ea17a27b0f159b5383afe06

SHA256
2667325aabe1be030773262c4d9ea27e595d4fef34980433d285a83615f8bae0

SHA512
0e2f6494f40f53137b77b57066a51cc2e1b1e280d0279439b59a7c75aa1d02c441c9da7fd56efd4df87b68d62aa5a71fe1091bf87b2ccffa96de19aa2e1bf1ac

Download Submit
memory/2116-0-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2116-7-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2300-8-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2300-9-0x0000000004FF0000-0x00000000050D5000-memory.dmp

Filesize
916KB

Download
memory/2300-10-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download