a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 01:42

Target

a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe
Size

1.1MB
MD5

b4c98a79ece4709578cb71687dd964ef
SHA1

eb46ffca99c82668f5dae7f3097d103d8254bf2c
SHA256

a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947
SHA512

e5f19a3acb38789f429d0dcce061498aa5c3083c5da56aa9a27e1951b23f892366f404658a5e84ffcd517cd42fa67adc86ab46236d3bcf925f85499c5d99f31c
SSDEEP

24576:gAHnh+eWsN3skA4RV1Hom2KXMmHa3xpvrd1TpY2zntv7UrIGwOn5:Xh+ZkldoPK8Ya3xhTLzntvgrIg

Score

7^/10

Drops startup file 1 IoCs

Processes:

reenjoys.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reenjoys.vbs reenjoys.exe
Executes dropped EXE 1 IoCs

Processes:

reenjoys.exe

pid process

3940 reenjoys.exe
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\acrorrheuma\reenjoys.exe autoit_exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3476 3940 WerFault.exe reenjoys.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exereenjoys.exe

pid process

1100 a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe
1100 a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe
3940 reenjoys.exe
3940 reenjoys.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exereenjoys.exe

pid process

1100 a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe
1100 a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe
3940 reenjoys.exe
3940 reenjoys.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reenjoys.vbs	reenjoys.exe

pid	process
3940	reenjoys.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\acrorrheuma\reenjoys.exe	autoit_exe

pid	pid_target	process	target process
3476	3940	WerFault.exe	reenjoys.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exereenjoys.exe

description	pid	process	target process
PID 1100 wrote to memory of 3940	1100	a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe	reenjoys.exe
PID 1100 wrote to memory of 3940	1100	a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe	reenjoys.exe
PID 1100 wrote to memory of 3940	1100	a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe	reenjoys.exe
PID 3940 wrote to memory of 696	3940	reenjoys.exe	RegSvcs.exe
PID 3940 wrote to memory of 696	3940	reenjoys.exe	RegSvcs.exe
PID 3940 wrote to memory of 696	3940	reenjoys.exe	RegSvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe"
3⤵
PID:696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 696
3⤵
- Program crash
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3940 -ip 3940
1⤵
PID:4224

C:\Users\Admin\AppData\Local\Temp\peaks
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\acrorrheuma\reenjoys.exe
Filesize
1.1MB

MD5
b4c98a79ece4709578cb71687dd964ef

SHA1
eb46ffca99c82668f5dae7f3097d103d8254bf2c

SHA256
a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947

SHA512
e5f19a3acb38789f429d0dcce061498aa5c3083c5da56aa9a27e1951b23f892366f404658a5e84ffcd517cd42fa67adc86ab46236d3bcf925f85499c5d99f31c

Download Submit
memory/1100-10-0x0000000001250000-0x0000000001254000-memory.dmp

Filesize
16KB

Download