Analysis

  • max time kernel
    148s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2022, 07:17

General

  • Target

    25be82cda3ee187b85ad2c2ca8000e9bdc046cb4d1d904ea26a7ab007633f92e.exe

  • Size

    51KB

  • MD5

    533cad60804864b5de5264d5d511ba1f

  • SHA1

    d2f510d08edbbc09afb760501542b40e300a98f5

  • SHA256

    25be82cda3ee187b85ad2c2ca8000e9bdc046cb4d1d904ea26a7ab007633f92e

  • SHA512

    1c3fc02f578e8e51553c3f76deabf2cdbb9f2ab898c8a561b9948242f9a5c561b13ae6f1f94e82db8fc2e6b9937b22a3bf01b06b93dd25c86e91ef3e2661a12e

  • SSDEEP

    768:Vec8yXVUWk2qjT5yt6Cjur4vFHuj9ZhjzRYxXimDsOyuSCKRTtvf5KmW:cYXVDy9KqJdYxXimwLZXTtn5KD

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\25be82cda3ee187b85ad2c2ca8000e9bdc046cb4d1d904ea26a7ab007633f92e.exe
    "C:\Users\Admin\AppData\Local\Temp\25be82cda3ee187b85ad2c2ca8000e9bdc046cb4d1d904ea26a7ab007633f92e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4152
    • C:\Users\Admin\AppData\Local\Temp\25be82cda3ee187b85ad2c2ca8000e9bdc046cb4d1d904ea26a7ab007633f92e.exe
      C:\Users\Admin\AppData\Local\Temp\25be82cda3ee187b85ad2c2ca8000e9bdc046cb4d1d904ea26a7ab007633f92e.exe
      2⤵
        PID:1920
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 284
        2⤵
        • Program crash
        PID:3932
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 304
        2⤵
        • Program crash
        PID:5116
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4152 -ip 4152
      1⤵
        PID:372
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4152 -ip 4152
        1⤵
          PID:4400

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1920-134-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

        • memory/1920-136-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

        • memory/1920-137-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB