Analysis
-
max time kernel
61s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2022 02:05
Static task
static1
Behavioral task
behavioral1
Sample
56a8832a8fe73bc31a8d7f1d6c5e101db792ea7efd220f74e1b1263359057b09.exe
Resource
win7-20220718-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
56a8832a8fe73bc31a8d7f1d6c5e101db792ea7efd220f74e1b1263359057b09.exe
Resource
win10v2004-20220721-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
56a8832a8fe73bc31a8d7f1d6c5e101db792ea7efd220f74e1b1263359057b09.exe
-
Size
1.0MB
-
MD5
7693700a5eb55f2442a6ec0400872661
-
SHA1
51db686d92d80d48ee48905f5d0e853d4513ca5a
-
SHA256
56a8832a8fe73bc31a8d7f1d6c5e101db792ea7efd220f74e1b1263359057b09
-
SHA512
ba5621a0cf0b07a3a5f669046531f598cc4f9497ba888e1eb59ac08b47fe7df3d34067c70e3daca458df339411bab21a518d487010bf4a94b4b2598af5a7a2b8
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4244 2072 WerFault.exe 56a8832a8fe73bc31a8d7f1d6c5e101db792ea7efd220f74e1b1263359057b09.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
56a8832a8fe73bc31a8d7f1d6c5e101db792ea7efd220f74e1b1263359057b09.exepid process 2072 56a8832a8fe73bc31a8d7f1d6c5e101db792ea7efd220f74e1b1263359057b09.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\56a8832a8fe73bc31a8d7f1d6c5e101db792ea7efd220f74e1b1263359057b09.exe"C:\Users\Admin\AppData\Local\Temp\56a8832a8fe73bc31a8d7f1d6c5e101db792ea7efd220f74e1b1263359057b09.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:2072 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 3802⤵
- Program crash
PID:4244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2072 -ip 20721⤵PID:3536
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2072-130-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB