Overview

overview

8

Static

static

8

6dee8fc488...ac.exe

windows7-x64

8

6dee8fc488...ac.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    93s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2022, 09:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6dee8fc4887ae856c6e0d88a4eedba607ffa8b9ea336c3d44f7821238243bfac.exe

  • Size

    27KB

  • MD5

    ff830b25ec35e2ad4710ef19dfc13189

  • SHA1

    1d6a77bdeb9a847b83225b8d867106b559ff3b38

  • SHA256

    6dee8fc4887ae856c6e0d88a4eedba607ffa8b9ea336c3d44f7821238243bfac

  • SHA512

    7a4a7a4aadf5189f7a94c7f753099af909a40d7fd7714ea26d3124547b97978068b4080e3b1b697ae120ae190f26255a47b9f9ffb32a09c6fcea4874da6b9c4b

  • SSDEEP

    768:pqQ8OFPVRb7zLozkJ3ikkuZKHvZik8ObSLQ+2:M7OFP4YJ3ruv0rbc+2

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6dee8fc4887ae856c6e0d88a4eedba607ffa8b9ea336c3d44f7821238243bfac.exe
    "C:\Users\Admin\AppData\Local\Temp\6dee8fc4887ae856c6e0d88a4eedba607ffa8b9ea336c3d44f7821238243bfac.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:5080
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
        PID:2388
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 204
          3⤵
          • Program crash
          PID:3656
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 212
          3⤵
          • Program crash
          PID:4788
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2388 -ip 2388
      1⤵
        PID:784
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2388 -ip 2388
        1⤵
          PID:3948

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2388-134-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

          Download

        • memory/5080-133-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

          Download