Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
27-04-2024 22:18
General
-
Target
ee3a18ad44e3d4701f0911fef80adbc78024f8ee478f70df3361332d50b40d72.exe
-
Size
520KB
-
MD5
183ac95593844a7b58c4b01a52f32f97
-
SHA1
c75411a599aaa0cd6b71349d59c0381f27c5d47f
-
SHA256
ee3a18ad44e3d4701f0911fef80adbc78024f8ee478f70df3361332d50b40d72
-
SHA512
a85b32d9b457ad8ddc05015ae894d657e330ef6a94f47fffb91cd74257c052896e2c14045f47500047a73d477266a60939610dfc45f87a1eb9072eaa1d950897
-
SSDEEP
12288:KaTSbL2PPqAbJSFB4L84CRK83KspOQqyXzrSWbwiwkDs1i/IU+oLoSFcigx1/hPP:zeO3bJScN83KsBqKP3k2s1i/vcx7
Score
7/10
Malware Config
Signatures
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Program crash 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee3a18ad44e3d4701f0911fef80adbc78024f8ee478f70df3361332d50b40d72.exe"C:\Users\Admin\AppData\Local\Temp\ee3a18ad44e3d4701f0911fef80adbc78024f8ee478f70df3361332d50b40d72.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 10002⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2460-0-0x0000000000400000-0x0000000000542000-memory.dmpFilesize
1.3MB
-
memory/2460-3-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2460-6-0x0000000000400000-0x0000000000542000-memory.dmpFilesize
1.3MB
-
memory/2460-8-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB