ccfa2a67d01921867191fc088fd2e3c5c60209b1e6423e1586218d739f47a145 | Triage™

Analysis

max time kernel
138s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2022, 18:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Variant.Lazy.232996.11026.exe
Size 110KB
Sample220820-w8bfwsfbgr
SHA256 ccfa2a67d01921867191fc088fd2e3c5c60209b1e6423e1586218d739f47a145
MD5 50cdf8376fd1df608f94a0acabe0fbba
SHA1 607cb371ca1fb8602c0b059ea9cfe61361a45fa7
SHA512 ed14a44f20a6776d58495268dc2ecf019eba55ce48e25faf8f5309429e33569a3cd4da4604b42d15280bcba60acb2f1d7dc37c7ea683f74a0164fa907df546bc
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1964	5088	WerFault.exe	58

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5088	SecuriteInfo.com.Variant.Lazy.232996.11026.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.232996.11026.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.232996.11026.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:5088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 264
  2⤵
  - Program crash
  PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5088 -ip 5088
1⤵
PID:4344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads