Overview

overview

5

Static

static

ad353b7e54...79.exe

windows7-x64

5

ad353b7e54...79.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    113s
  • max time network
    183s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/10/2022, 15:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    ad353b7e54c26a187631a606b4c21f9e0c5d4bf4d21d4b3dcd3f18095bd61e79.exe

  • Size

    27KB

  • MD5

    800275a0a1f9904e214ea591845c7d30

  • SHA1

    2e5f1259d94707c3ae3a910a1be618cece575d96

  • SHA256

    ad353b7e54c26a187631a606b4c21f9e0c5d4bf4d21d4b3dcd3f18095bd61e79

  • SHA512

    265304ec7a55d565e10f2772e1a083a3272e84d69e539d4e3da4a155b84c8b12ae876f72ee89235f4d139981720597e131d340de345793ea9b977c866d4ae939

  • SSDEEP

    384:Ui6jJNhmZS5q18OfWaODfDOObgc6HhO8lBhGVBOaQybPp1bHZ:9cUZSA17+RLRU9BOQI3d

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad353b7e54c26a187631a606b4c21f9e0c5d4bf4d21d4b3dcd3f18095bd61e79.exe
    "C:\Users\Admin\AppData\Local\Temp\ad353b7e54c26a187631a606b4c21f9e0c5d4bf4d21d4b3dcd3f18095bd61e79.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:5092
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
        PID:2176
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 12
          3⤵
          • Program crash
          PID:4664
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2176 -ip 2176
      1⤵
        PID:1324

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/2176-134-0x0000000000400000-0x0000000000405000-memory.dmp

              Filesize

              20KB

              Download

            • memory/5092-132-0x0000000000400000-0x000000000040A000-memory.dmp

              Filesize

              40KB

              Download

            • memory/5092-135-0x0000000000400000-0x000000000040A000-memory.dmp

              Filesize

              40KB

              Download