5a8b4a699d047db03d9da60e85de9306ff0d80c9d70378a8b33ba44ed6028206

Analysis

max time kernel
105s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 16:59

Target

eedf148e075731d79b1183b1d2dd2fa0N.exe
Size

203KB
MD5

eedf148e075731d79b1183b1d2dd2fa0
SHA1

b36258cb54f4dce3c8b9b345fbab120a389e62a2
SHA256

5a8b4a699d047db03d9da60e85de9306ff0d80c9d70378a8b33ba44ed6028206
SHA512

659fc19843b662da16c316e0e62a6e405e342d9be4d377919adc5ee6e2c76838cbc4856667e2406c32f33bece932b14841941ebf45653b380372239e708fb3f4
SSDEEP

6144:Zg4hF4N64dPfG4DwbiM1G7wsyi4y3G1B78:6kF4w4dGRV1G7wNiZG1BA

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4716	eedf148e075731d79b1183b1d2dd2fa0N.exe

Executes dropped EXE 1 IoCs

pid	Process
4716	eedf148e075731d79b1183b1d2dd2fa0N.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1384	4936	WerFault.exe	83
4888	4716	WerFault.exe	91

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4936	eedf148e075731d79b1183b1d2dd2fa0N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4716	eedf148e075731d79b1183b1d2dd2fa0N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 4716	4936	eedf148e075731d79b1183b1d2dd2fa0N.exe	91
PID 4936 wrote to memory of 4716	4936	eedf148e075731d79b1183b1d2dd2fa0N.exe	91
PID 4936 wrote to memory of 4716	4936	eedf148e075731d79b1183b1d2dd2fa0N.exe	91

C:\Users\Admin\AppData\Local\Temp\eedf148e075731d79b1183b1d2dd2fa0N.exe
"C:\Users\Admin\AppData\Local\Temp\eedf148e075731d79b1183b1d2dd2fa0N.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 396
  2⤵
  - Program crash
  PID:1384
- C:\Users\Admin\AppData\Local\Temp\eedf148e075731d79b1183b1d2dd2fa0N.exe
  C:\Users\Admin\AppData\Local\Temp\eedf148e075731d79b1183b1d2dd2fa0N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 364
    3⤵
    - Program crash
    PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4936 -ip 4936
1⤵
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4716 -ip 4716
1⤵
PID:1256

C:\Users\Admin\AppData\Local\Temp\eedf148e075731d79b1183b1d2dd2fa0N.exe

Filesize
203KB

MD5
0d9d502fe1067f13e38af6c956473d40

SHA1
41b604b7e0a42ce3a513d5ab37534753cc86ed22

SHA256
3e572feeae3cead6b1c0e5b0dd49018e1b866df8448106c3f56414c75b7ba9d2

SHA512
8a40ff58bdbb5e640dee76fd13aae23ded0b51c425a1a21a31670ec292902e335a30a5bff6f60f56e385d9c8a18f69d7acbaaa8a782c5dbedabcad2911661631

Download Submit
memory/4716-7-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4716-13-0x0000000001510000-0x000000000154F000-memory.dmp

Filesize
252KB

Download
memory/4716-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4936-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4936-6-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download