52e9e9d911b77b9bd51d3d82c0d3eb7c1966b1d90b0180eda5738cc510af0627

Analysis

max time kernel
101s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 04:21

Target

5c3d9b878eea62e80af1826568239fc0N.exe
Size

320KB
MD5

5c3d9b878eea62e80af1826568239fc0
SHA1

3bcaaa4e994ff4a1368ce691f35ce8fec352aab3
SHA256

52e9e9d911b77b9bd51d3d82c0d3eb7c1966b1d90b0180eda5738cc510af0627
SHA512

3a2d0e4907ae081048bb6a126c43fed76379f1e85ee6703a2a0b39ca737a81461f645e592be64675f8b10a92cabca2d5bced864f2f62e3a749457fd4a31f401e
SSDEEP

6144:yHpj9B23XqRxok++qTSm4n+XaJ8ITKHcnKG1B7qV40saiigCDN:yJD2Yok++ESm4n+XaB7KG1BmVQ5zCDN

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3708	5c3d9b878eea62e80af1826568239fc0N.exe

Executes dropped EXE 1 IoCs

pid	Process
3708	5c3d9b878eea62e80af1826568239fc0N.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2124	4980	WerFault.exe	83
1048	3708	WerFault.exe	91

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4980	5c3d9b878eea62e80af1826568239fc0N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3708	5c3d9b878eea62e80af1826568239fc0N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 3708	4980	5c3d9b878eea62e80af1826568239fc0N.exe	91
PID 4980 wrote to memory of 3708	4980	5c3d9b878eea62e80af1826568239fc0N.exe	91
PID 4980 wrote to memory of 3708	4980	5c3d9b878eea62e80af1826568239fc0N.exe	91

C:\Users\Admin\AppData\Local\Temp\5c3d9b878eea62e80af1826568239fc0N.exe
"C:\Users\Admin\AppData\Local\Temp\5c3d9b878eea62e80af1826568239fc0N.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 396
  2⤵
  - Program crash
  PID:2124
- C:\Users\Admin\AppData\Local\Temp\5c3d9b878eea62e80af1826568239fc0N.exe
  C:\Users\Admin\AppData\Local\Temp\5c3d9b878eea62e80af1826568239fc0N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 364
    3⤵
    - Program crash
    PID:1048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4980 -ip 4980
1⤵
PID:4252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3708 -ip 3708
1⤵
PID:2356

C:\Users\Admin\AppData\Local\Temp\5c3d9b878eea62e80af1826568239fc0N.exe

Filesize
320KB

MD5
981ce430e4ca1610602ca10684ead804

SHA1
16562898119c6e12e88ebb6aeb024ffd6232390d

SHA256
625fb8a646ac7a466f75920332381c5e315da4f6b7291aa87d778b7d799c9777

SHA512
b82edd11d913eb4c9ade99b3b6d8f2b5c2e58c9d6f3f625de629b98f3a9982e0b69f9a4304fde1c9daed70d794d81fdd3a9da603050df938c55341e850ebd277

Download Submit
memory/3708-7-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3708-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3708-13-0x0000000004D40000-0x0000000004D7F000-memory.dmp

Filesize
252KB

Download
memory/4980-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4980-6-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download