2a706a9e4d079bc89dcddb7b9ab7c45f70975781728724ff8c555c40076eb9a0

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 11:54

Target

d37bff488dfef0a22d17d0eec6517e60N.exe
Size

5.0MB
MD5

d37bff488dfef0a22d17d0eec6517e60
SHA1

f4eabd5bacfc9fb22266988b5a84a59a045dc6ba
SHA256

2a706a9e4d079bc89dcddb7b9ab7c45f70975781728724ff8c555c40076eb9a0
SHA512

c9a5b516f6c00cbd55702cd4db04188805e1fc00481cf82fe4e98965f0d3334f95f8076a5027790032501df17e2a7856d2010ba39e434a7cb33395938e30e9b2
SSDEEP

49152:p8YDVwFx+CgfniXtXIMfX2wGBDDQ/XSHdX4MPXGgYwUyp:p8YDVw9XtWHdC/yp

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2692	d37bff488dfef0a22d17d0eec6517e60N.exe

Executes dropped EXE 1 IoCs

pid	Process
2692	d37bff488dfef0a22d17d0eec6517e60N.exe

Loads dropped DLL 4 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1248	2692	WerFault.exe	31

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2536	d37bff488dfef0a22d17d0eec6517e60N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2692	d37bff488dfef0a22d17d0eec6517e60N.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2692	2536	d37bff488dfef0a22d17d0eec6517e60N.exe	31
PID 2536 wrote to memory of 2692	2536	d37bff488dfef0a22d17d0eec6517e60N.exe	31
PID 2536 wrote to memory of 2692	2536	d37bff488dfef0a22d17d0eec6517e60N.exe	31
PID 2536 wrote to memory of 2692	2536	d37bff488dfef0a22d17d0eec6517e60N.exe	31
PID 2692 wrote to memory of 1248	2692	d37bff488dfef0a22d17d0eec6517e60N.exe	32
PID 2692 wrote to memory of 1248	2692	d37bff488dfef0a22d17d0eec6517e60N.exe	32
PID 2692 wrote to memory of 1248	2692	d37bff488dfef0a22d17d0eec6517e60N.exe	32
PID 2692 wrote to memory of 1248	2692	d37bff488dfef0a22d17d0eec6517e60N.exe	32

\Users\Admin\AppData\Local\Temp\d37bff488dfef0a22d17d0eec6517e60N.exe

Filesize
5.0MB

MD5
42f0c92d854bc97c57685e2fecbea090

SHA1
9a81217692b1aaa8ab9f2ce36696e8ec842d2893

SHA256
671f25836d31be05c2aaa80535304ec1a5f74f479310524fb4fa14143945d469

SHA512
6684dff08033c3461ac5d92239d4d8c7275a7f6a8aaff342c907ca02c0b0b0fef544eadab9d02d7a6d9c9d5b7e4136db09aeab241ca68a37a7c7421539117e02

Download Submit
memory/2536-0-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2536-6-0x0000000002E60000-0x0000000002F45000-memory.dmp

Filesize
916KB

Download
memory/2536-9-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2692-11-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2692-12-0x0000000002E80000-0x0000000002F65000-memory.dmp

Filesize
916KB

Download