0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076 | Triage™

Analysis

max time kernel
120s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
06/03/2022, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe
Size 594KB
Sample220306-2wdclsgbc2
SHA256 0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076
MD5 0faf60f6b58a9280cd519653658a95a7
SHA1 5f24e4075ebc1e44747093a996e346e013004821
SHA512 b1ee924b7a13819e8d0bbd36226093183bd9e5cb4d91021866d1f61aa69ada6174c19854ba30469e232c6e15e4f0f2ad040f315d47484a27c9dc97fbc337ead5
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4116 set thread context of 532	4116	0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe	80

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1292	532	WerFault.exe	80

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4116	0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe
4116	0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 532	4116	0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe	80
PID 4116 wrote to memory of 532	4116	0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe	80
PID 4116 wrote to memory of 532	4116	0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe	80
PID 4116 wrote to memory of 532	4116	0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe	80

C:\Users\Admin\AppData\Local\Temp\0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe
"C:\Users\Admin\AppData\Local\Temp\0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Users\Admin\AppData\Local\Temp\0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe
  "C:\Users\Admin\AppData\Local\Temp\0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe"
  2⤵
  PID:532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 396
    3⤵
    - Program crash
    PID:1292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 532 -ip 532
1⤵
PID:1436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4116-131-0x00000000012FD000-0x0000000001300000-memory.dmp

Download