f9b53b6c893db7d89094b2aef8b98e735dacd7916ec453cb576922058caf2f49

Analysis

max time kernel
100s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 18:47

Target

fd877ae3cc1e9df7359f73a4bcea5c10N.exe
Size

2.0MB
MD5

fd877ae3cc1e9df7359f73a4bcea5c10
SHA1

73b342548890e7433db8c5b8839824e28107c537
SHA256

f9b53b6c893db7d89094b2aef8b98e735dacd7916ec453cb576922058caf2f49
SHA512

62edb56583c39ad60ea02adc813a47399960304ceee8ede607b6d0e748ba987461c9784d592c44b2d416ee13a89ed365db2540408e2ab23df310b64452d1b2fe
SSDEEP

24576:ffh270tEpIa/ZSdniF+ujZXIMfX2av5SAODg:U4lg0niXtXIMfX2wG0

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1800	fd877ae3cc1e9df7359f73a4bcea5c10N.exe

Executes dropped EXE 1 IoCs

pid	Process
1800	fd877ae3cc1e9df7359f73a4bcea5c10N.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1564	4516	WerFault.exe	83
2012	1800	WerFault.exe	91
4880	1800	WerFault.exe	91

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4516	fd877ae3cc1e9df7359f73a4bcea5c10N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1800	fd877ae3cc1e9df7359f73a4bcea5c10N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 1800	4516	fd877ae3cc1e9df7359f73a4bcea5c10N.exe	91
PID 4516 wrote to memory of 1800	4516	fd877ae3cc1e9df7359f73a4bcea5c10N.exe	91
PID 4516 wrote to memory of 1800	4516	fd877ae3cc1e9df7359f73a4bcea5c10N.exe	91

C:\Users\Admin\AppData\Local\Temp\fd877ae3cc1e9df7359f73a4bcea5c10N.exe
"C:\Users\Admin\AppData\Local\Temp\fd877ae3cc1e9df7359f73a4bcea5c10N.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 344
  2⤵
  - Program crash
  PID:1564
- C:\Users\Admin\AppData\Local\Temp\fd877ae3cc1e9df7359f73a4bcea5c10N.exe
  C:\Users\Admin\AppData\Local\Temp\fd877ae3cc1e9df7359f73a4bcea5c10N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 344
    3⤵
    - Program crash
    PID:2012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 360
    3⤵
    - Program crash
    PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4516 -ip 4516
1⤵
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1800 -ip 1800
1⤵
PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1800 -ip 1800
1⤵
PID:3500

C:\Users\Admin\AppData\Local\Temp\fd877ae3cc1e9df7359f73a4bcea5c10N.exe

Filesize
2.0MB

MD5
eb8d745e188bb59c7e01f58bd19ce76b

SHA1
73ce7e95bd4e0b853b1e4c2608cac18546ac13c5

SHA256
7b46420222f8bae0606d4846b2984cec704ab30ab106aebaf2cf75090e710dea

SHA512
d62639c23444b860d310d359922bad29b5e00151c22ed14cdbc0e762bd6a5e943ce72bdf143360f8a4f38d5e6d23300fc788680eb3d17e49b72b8df60189a585

Download Submit
memory/1800-7-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download
memory/1800-8-0x0000000004F20000-0x0000000005006000-memory.dmp

Filesize
920KB

Download
memory/1800-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4516-0-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download
memory/4516-6-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download