2775e955bf03d93033ff2bf432ad95158e176d3207962d18dc47fd074d16ba9e

Analysis

max time kernel
154s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
06/03/2022, 00:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
15ec60464f604fbc14d3daf6610c881d.exe
Size 1.1MB
Sample220306-asc4wshfd7
SHA256 2775e955bf03d93033ff2bf432ad95158e176d3207962d18dc47fd074d16ba9e
MD5 15ec60464f604fbc14d3daf6610c881d
SHA1 a9b071f9744f11c5c980ef1c0899da646261f5ef
SHA512 8f33458294bd027a565c79bff1a467b8946fc05e37d0075854ab1f12d1f471d33222d368b2735f711fb3ec72f748cb3555f063b11987421c59c0c976f7554fa3
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 7 IoCs

flow	pid	Process
17	516	rundll32.exe
33	516	rundll32.exe
38	516	rundll32.exe
39	516	rundll32.exe
41	516	rundll32.exe
43	516	rundll32.exe
44	516	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3016	3936	WerFault.exe	55

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57
PID 3936 wrote to memory of 516	3936	15ec60464f604fbc14d3daf6610c881d.exe	57

C:\Users\Admin\AppData\Local\Temp\15ec60464f604fbc14d3daf6610c881d.exe
"C:\Users\Admin\AppData\Local\Temp\15ec60464f604fbc14d3daf6610c881d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  - Blocklisted process makes network request
  PID:516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 612
  2⤵
  - Program crash
  PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3936 -ip 3936
1⤵
PID:3000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/516-141-0x0000000002F00000-0x0000000002F03000-memory.dmp

Download

memory/516-142-0x0000000002F10000-0x0000000002F13000-memory.dmp

Download

memory/516-152-0x0000000002FB0000-0x0000000002FB3000-memory.dmp

Download

memory/516-151-0x0000000002FA0000-0x0000000002FA3000-memory.dmp

Download

memory/516-149-0x0000000002F80000-0x0000000002F83000-memory.dmp

Download

memory/516-136-0x0000000002ED0000-0x0000000002ED3000-memory.dmp

Download

memory/516-137-0x0000000077190000-0x0000000077333000-memory.dmp

Download

memory/516-138-0x0000000075410000-0x00000000755B0000-memory.dmp

Download

memory/516-140-0x0000000002EF0000-0x0000000002EF3000-memory.dmp

Download

memory/516-143-0x0000000002F20000-0x0000000002F23000-memory.dmp

Download

memory/516-150-0x0000000002F90000-0x0000000002F93000-memory.dmp

Download

memory/516-148-0x0000000002F70000-0x0000000002F73000-memory.dmp

Download

memory/516-139-0x0000000002EE0000-0x0000000002EE3000-memory.dmp

Download

memory/516-144-0x0000000002F30000-0x0000000002F33000-memory.dmp

Download

memory/516-145-0x0000000002F40000-0x0000000002F43000-memory.dmp

Download

memory/516-146-0x0000000002F50000-0x0000000002F53000-memory.dmp

Download

memory/516-147-0x0000000002F60000-0x0000000002F63000-memory.dmp

Download

memory/3936-131-0x000000000225F000-0x0000000002343000-memory.dmp

Download

memory/3936-132-0x0000000002390000-0x00000000025C7000-memory.dmp

Download

memory/3936-135-0x0000000077190000-0x0000000077333000-memory.dmp

Download

memory/3936-134-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/3936-133-0x0000000000400000-0x0000000000643000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads