52fcacd0a3ab4a6106aaebf4edc3397bb36e08c0f48ac6eab6460ab9cb1ede6e

Analysis

max time kernel
123s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
05/03/2022, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6ac07b68a5d473eefb6df7a884d49bce.exe
Size 755KB
Sample220305-ws68maghb5
SHA256 52fcacd0a3ab4a6106aaebf4edc3397bb36e08c0f48ac6eab6460ab9cb1ede6e
MD5 6ac07b68a5d473eefb6df7a884d49bce
SHA1 97ea9e45a1bfef2858ad3a2ac927eb0dac906b24
SHA512 95e146e6920caf95f3244b31ddb44b40f67253873085e839d8f4bb13a97aee2cc59e72e056bb16fb6a1b45f3ba9fb6c881a65821b5014134981d33d5c0c9534a
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3932 set thread context of 388	3932	6ac07b68a5d473eefb6df7a884d49bce.exe	56

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3544	3932	WerFault.exe	55
3584	388	WerFault.exe	56

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 388	3932	6ac07b68a5d473eefb6df7a884d49bce.exe	56
PID 3932 wrote to memory of 388	3932	6ac07b68a5d473eefb6df7a884d49bce.exe	56
PID 3932 wrote to memory of 388	3932	6ac07b68a5d473eefb6df7a884d49bce.exe	56
PID 3932 wrote to memory of 388	3932	6ac07b68a5d473eefb6df7a884d49bce.exe	56
PID 3932 wrote to memory of 388	3932	6ac07b68a5d473eefb6df7a884d49bce.exe	56
PID 3932 wrote to memory of 388	3932	6ac07b68a5d473eefb6df7a884d49bce.exe	56
PID 3932 wrote to memory of 388	3932	6ac07b68a5d473eefb6df7a884d49bce.exe	56
PID 3932 wrote to memory of 388	3932	6ac07b68a5d473eefb6df7a884d49bce.exe	56
PID 3932 wrote to memory of 388	3932	6ac07b68a5d473eefb6df7a884d49bce.exe	56

C:\Users\Admin\AppData\Local\Temp\6ac07b68a5d473eefb6df7a884d49bce.exe
"C:\Users\Admin\AppData\Local\Temp\6ac07b68a5d473eefb6df7a884d49bce.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Users\Admin\AppData\Local\Temp\6ac07b68a5d473eefb6df7a884d49bce.exe
  "C:\Users\Admin\AppData\Local\Temp\6ac07b68a5d473eefb6df7a884d49bce.exe"
  2⤵
  PID:388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 388 -s 228
    3⤵
    - Program crash
    PID:3584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 416
  2⤵
  - Program crash
  PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3932 -ip 3932
1⤵
PID:3980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 388 -ip 388
1⤵
PID:3316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/388-138-0x0000000000400000-0x0000000000893000-memory.dmp

Download

memory/388-139-0x0000000000400000-0x0000000000893000-memory.dmp

Download

memory/3932-133-0x000000000240A000-0x000000000248F000-memory.dmp

Download

memory/3932-135-0x0000000002510000-0x00000000025B3000-memory.dmp

Download

memory/3932-134-0x0000000000400000-0x00000000006BA000-memory.dmp

Download

memory/3932-136-0x00000000025C0000-0x0000000002631000-memory.dmp

Download

memory/3932-137-0x0000000002650000-0x00000000026E6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads