e6ea211b08ac50278feea0a94906d6902b952e97c0d94b38ea683c20c1b1fdc4

Analysis

Target

DOCUMENTS.exe
Size

461KB
MD5

12d57069130c72bacbe0687b79d633e8
SHA1

5dd72d6f4361861559721e161414e2355dacefe9
SHA256

d887251ccd6c44329798ec262da14733ab9573b28ef725e31834d8b79e9f840d
SHA512

d6320b3362140a7105917626443ae52e7cbcbcde4ef9cc7be0af82c977509009ebfdf0c3b99a5455f4387a87ea5d6c1363eecaf026033d9cc0d5565981763410

Score

10^/10

coreentity rezer0

CoreEntity .NET Packer 1 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

Processes:

resource	yara_rule
behavioral1/memory/988-57-0x0000000000560000-0x0000000000568000-memory.dmp	coreentity

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

Processes:

resource	yara_rule
behavioral1/memory/988-58-0x0000000004230000-0x0000000004286000-memory.dmp	rezer0

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

956 988 WerFault.exe DOCUMENTS.exe

pid	pid_target	process	target process
956	988	WerFault.exe	DOCUMENTS.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

DOCUMENTS.exe

description	pid	process	target process
PID 988 wrote to memory of 956	988	DOCUMENTS.exe	WerFault.exe
PID 988 wrote to memory of 956	988	DOCUMENTS.exe	WerFault.exe
PID 988 wrote to memory of 956	988	DOCUMENTS.exe	WerFault.exe
PID 988 wrote to memory of 956	988	DOCUMENTS.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\DOCUMENTS.exe
"C:\Users\Admin\AppData\Local\Temp\DOCUMENTS.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 688
2⤵
- Program crash
PID:956

memory/956-59-0x0000000000000000-mapping.dmp

Download
memory/988-54-0x0000000000200000-0x000000000027A000-memory.dmp

Filesize
488KB

Download
memory/988-55-0x0000000001F00000-0x0000000001F64000-memory.dmp

Filesize
400KB

Download
memory/988-56-0x0000000075C71000-0x0000000075C73000-memory.dmp

Filesize
8KB

Download
memory/988-57-0x0000000000560000-0x0000000000568000-memory.dmp

Filesize
32KB

Download
memory/988-58-0x0000000004230000-0x0000000004286000-memory.dmp

Filesize
344KB

Download