Analysis
- max time kernel
3s - max time network
10s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/01/2021, 09:12
General
- Target 54f5f7c5c74cb688f97f99aef2279beb.exe
- Size 510KB
- Sample210109-tkdgfe3lts
- SHA256 3f5bc52dbad154f0693d28e459ff19c203c93ec58d6d99fa86631b049ba9746a
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\54f5f7c5c74cb688f97f99aef2279beb.exe"C:\Users\Admin\AppData\Local\Temp\54f5f7c5c74cb688f97f99aef2279beb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1636-2-0x00000000045D9000-0x00000000045EA000-memory.dmp
memory/1636-3-0x00000000046D0000-0x00000000046E1000-memory.dmp
memory/1636-4-0x0000000010000000-0x0000000010089000-memory.dmp
memory/1636-7-0x00000000004E0000-0x00000000005A9000-memory.dmp