6715c0eff16eb7fb62b4e3c5f355b0548c695e5b12705a731a9abb4f8c7fef31

Analysis

max time kernel
71s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-10-2022 13:25

Target

Setup.exe
Size

706.6MB
MD5

c3cc4a0e6e795464c7d4b5b96c91d70b
SHA1

dd398b58669733bbb48363f4ee163f3f9b1e6325
SHA256

856ee338756462e8041fa057c1a2a578536de2a6c559052c7e39f00760296e72
SHA512

d370f7c6bafe8676823b679706ab56a07ce60b84db2f97695a06813d538a16d42a7bf4f07dd879f0d12a9d3c3fbcdc5470ec584ade2e4b9cd0c14d4db88ba549
SSDEEP

24576:8PsWvw98o3C6ZC6BqNmK/cRgOnmq9g6ZB36rKX6sWWl3RuQ55313:8Z08ozZqfcOU7m6TlLl3

Score

7^/10

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 1436 set thread context of 1628 1436 Setup.exe vbc.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3736 1436 WerFault.exe Setup.exe

description	pid	process	target process
PID 1436 set thread context of 1628	1436	Setup.exe	vbc.exe

pid	pid_target	process	target process
3736	1436	WerFault.exe	Setup.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 1436 wrote to memory of 1628	1436	Setup.exe	vbc.exe
PID 1436 wrote to memory of 1628	1436	Setup.exe	vbc.exe
PID 1436 wrote to memory of 1628	1436	Setup.exe	vbc.exe
PID 1436 wrote to memory of 1628	1436	Setup.exe	vbc.exe
PID 1436 wrote to memory of 1628	1436	Setup.exe	vbc.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 604
2⤵
- Program crash
PID:3736

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1436 -ip 1436
1⤵
PID:2204

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/1436-132-0x0000000000400000-0x000000000059A000-memory.dmp

Filesize
1.6MB

Download
memory/1436-142-0x0000000000400000-0x000000000059A000-memory.dmp

Filesize
1.6MB

Download
memory/1436-143-0x00000000007A0000-0x0000000000800000-memory.dmp

Filesize
384KB

Download
memory/1628-133-0x0000000000000000-mapping.dmp

Download
memory/1628-134-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1628-141-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download