46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8.exe
Size

2.5MB
MD5

ec9f337d124f164eca96ad5530ce68ae
SHA1

2916b6663d6a88e71f5e2a13b37b69f0b6407e6a
SHA256

46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8
SHA512

85e7b389e28aae7ccc7d4001c5cc5fa0a84ba1298d6c7176216195894dfe2b5a9a86077a0ce2ae108d57609bd6747ca00d3142a1a77f22c9840ba13ce8d457d5
SSDEEP

49152:P7rh44O53c5IH0fNW822P8sGguwrbARb4j26Pt+8b24Koje/9d4K6N:Hhc5MSH0fuuH2wKMpl+Oj+4K

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
844	1500	WerFault.exe	26

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ = "this is my ebook"	46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32	46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8.MyNSHandler	46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8.MyNSHandler\Clsid\ = "{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}"	46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID\ = "46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8.MyNSHandler"	46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}	46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8.exe"	46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8.MyNSHandler\ = "this is my ebook"	46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8.MyNSHandler\Clsid	46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID	46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 844	1500	46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8.exe	27
PID 1500 wrote to memory of 844	1500	46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8.exe	27
PID 1500 wrote to memory of 844	1500	46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8.exe	27
PID 1500 wrote to memory of 844	1500	46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8.exe	27

C:\Users\Admin\AppData\Local\Temp\46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8.exe
"C:\Users\Admin\AppData\Local\Temp\46bde5bad5b38d48f7ddb7fce0104974c940a9a7dc405136e78e2ddedbabf0c8.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 396
  2⤵
  - Program crash
  PID:844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1500-54-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1500-56-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads