70bee3fa2bf61c13b1e94ab33d6ac070ef107085c10abb28ccb92e5b6449deee

Analysis

max time kernel
52s
max time network
75s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
01/04/2022, 13:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fd97fdb20a2238cfd5589bc05e14a80a.exe
Size 1.1MB
Sample220401-qnyg2agbek
SHA256 70bee3fa2bf61c13b1e94ab33d6ac070ef107085c10abb28ccb92e5b6449deee
MD5 fd97fdb20a2238cfd5589bc05e14a80a
SHA1 8f2904556c18ec2ee11d839af287e40d1eb30a1d
SHA512 6fd9dc5ff95cdbc5d35ce075c5320c65ab2a988e60375f5369891861b9bd053ee02d543333b04347ada6760288c4355d9f625ae25346118e1a39112815a111f1
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
1	4972	rundll32.exe
3	4972	rundll32.exe
4	64	rundll32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4852	400	WerFault.exe	75
4176	400	WerFault.exe	75

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 4972	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	77
PID 400 wrote to memory of 4972	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	77
PID 400 wrote to memory of 4972	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	77
PID 400 wrote to memory of 4972	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	77
PID 400 wrote to memory of 4972	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	77
PID 400 wrote to memory of 4972	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	77
PID 400 wrote to memory of 4972	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	77
PID 400 wrote to memory of 4972	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	77
PID 400 wrote to memory of 4972	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	77
PID 400 wrote to memory of 4972	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	77
PID 400 wrote to memory of 4972	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	77
PID 400 wrote to memory of 4972	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	77
PID 400 wrote to memory of 4972	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	77
PID 400 wrote to memory of 4972	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	77
PID 400 wrote to memory of 4972	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	77
PID 400 wrote to memory of 4972	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	77
PID 400 wrote to memory of 4972	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	77
PID 400 wrote to memory of 4972	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	77
PID 400 wrote to memory of 4972	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	77
PID 400 wrote to memory of 64	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	80
PID 400 wrote to memory of 64	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	80
PID 400 wrote to memory of 64	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	80
PID 400 wrote to memory of 64	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	80
PID 400 wrote to memory of 64	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	80
PID 400 wrote to memory of 64	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	80
PID 400 wrote to memory of 64	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	80
PID 400 wrote to memory of 64	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	80
PID 400 wrote to memory of 64	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	80
PID 400 wrote to memory of 64	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	80
PID 400 wrote to memory of 64	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	80
PID 400 wrote to memory of 64	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	80
PID 400 wrote to memory of 64	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	80
PID 400 wrote to memory of 64	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	80
PID 400 wrote to memory of 64	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	80
PID 400 wrote to memory of 64	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	80
PID 400 wrote to memory of 64	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	80
PID 400 wrote to memory of 64	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	80
PID 400 wrote to memory of 64	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	80
PID 400 wrote to memory of 4408	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	81
PID 400 wrote to memory of 4408	400	fd97fdb20a2238cfd5589bc05e14a80a.exe	81

C:\Users\Admin\AppData\Local\Temp\fd97fdb20a2238cfd5589bc05e14a80a.exe
"C:\Users\Admin\AppData\Local\Temp\fd97fdb20a2238cfd5589bc05e14a80a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  - Blocklisted process makes network request
  PID:4972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 612
  2⤵
  - Program crash
  PID:4852
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  - Blocklisted process makes network request
  PID:64
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  PID:4408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 872
  2⤵
  - Program crash
  PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 400 -ip 400
1⤵
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 400 -ip 400
1⤵
PID:2528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Peteqqaq.tmp

Path C:\Users\Admin\AppData\Local\Temp\Peteqqaq.tmp
Size 3.1MB
SHA256 6d6f9f4df698b469bdd198abfae9a769c8f75a3726b5cdfa1915dcab27432fad
MD5 dfac0a255119b0afcaf570634e3f28fa
SHA1 29c131335567192e6733295a77d50a3d3b574576
SHA512 ba650e74832dce3835121472de5f98eb8cf17b801fb86c668596e6364d370a5db4404e1c182fa94d384579abac72182698a76bbde1bc0aa57deedd2849094adf
SSDEEP 98304:zCXkSWsUUBWy4Ng1piz5m1ygr7SZEuRUkU61q:zCXmsrWyiaphvuY8q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Peteqqaq.tmp

Path C:\Users\Admin\AppData\Local\Temp\Peteqqaq.tmp
Size 3.1MB
SHA256 6d6f9f4df698b469bdd198abfae9a769c8f75a3726b5cdfa1915dcab27432fad
MD5 dfac0a255119b0afcaf570634e3f28fa
SHA1 29c131335567192e6733295a77d50a3d3b574576
SHA512 ba650e74832dce3835121472de5f98eb8cf17b801fb86c668596e6364d370a5db4404e1c182fa94d384579abac72182698a76bbde1bc0aa57deedd2849094adf
SSDEEP 98304:zCXkSWsUUBWy4Ng1piz5m1ygr7SZEuRUkU61q:zCXmsrWyiaphvuY8q
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/64-149-0x0000000000920000-0x0000000000923000-memory.dmp

Download

memory/64-150-0x0000000000930000-0x0000000000933000-memory.dmp

Download

memory/64-148-0x0000000000910000-0x0000000000913000-memory.dmp

Download

memory/64-147-0x0000000000900000-0x0000000000903000-memory.dmp

Download

memory/64-146-0x00000000008F0000-0x00000000008F3000-memory.dmp

Download

memory/400-152-0x0000000003D10000-0x0000000004761000-memory.dmp

Download

memory/400-126-0x0000000000400000-0x0000000000641000-memory.dmp

Download

memory/400-124-0x000000000097D000-0x0000000000A61000-memory.dmp

Download

memory/400-127-0x0000000000400000-0x0000000000641000-memory.dmp

Download

memory/400-125-0x0000000002410000-0x0000000002645000-memory.dmp

Download

memory/400-153-0x0000000003D10000-0x0000000004761000-memory.dmp

Download

memory/400-145-0x0000000002E90000-0x00000000038E1000-memory.dmp

Download

memory/400-128-0x0000000000400000-0x0000000000641000-memory.dmp

Download

memory/400-143-0x0000000002E90000-0x00000000038E1000-memory.dmp

Download

memory/4972-130-0x0000000000920000-0x0000000000922000-memory.dmp

Download

memory/4972-141-0x00000000009D0000-0x00000000009D2000-memory.dmp

Download

memory/4972-140-0x00000000009C0000-0x00000000009C2000-memory.dmp

Download

memory/4972-139-0x00000000009B0000-0x00000000009B2000-memory.dmp

Download

memory/4972-138-0x00000000009A0000-0x00000000009A2000-memory.dmp

Download

memory/4972-137-0x0000000000990000-0x0000000000992000-memory.dmp

Download

memory/4972-136-0x0000000000980000-0x0000000000982000-memory.dmp

Download

memory/4972-135-0x0000000000970000-0x0000000000972000-memory.dmp

Download

memory/4972-134-0x0000000000960000-0x0000000000962000-memory.dmp

Download

memory/4972-133-0x0000000000950000-0x0000000000952000-memory.dmp

Download

memory/4972-132-0x0000000000940000-0x0000000000942000-memory.dmp

Download

memory/4972-131-0x0000000000930000-0x0000000000932000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads