Analysis
-
max time kernel
44s -
max time network
22s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
28-10-2022 21:57
General
-
Target
e158c4a3c9a4ab5b71890a431a7ff9af52c047fe6183f2873690666cf487c744.exe
-
Size
240KB
-
MD5
0abe74ad896f43d5a5872506c63bf81f
-
SHA1
6bd0301981b42f509ca40f7aa341227e1f389902
-
SHA256
e158c4a3c9a4ab5b71890a431a7ff9af52c047fe6183f2873690666cf487c744
-
SHA512
89bbaa565a05a94b18959cbb6de4b3b160ef2cda280715dd5ffaab3e147e4e0e096dab5d487f9f868b764ccfde782a5c23efd8a5d15b0bcf5d25d32fdac4de1f
-
SSDEEP
6144:0RL7V/sBI2xqlMutSbkCpguZuqThPcV4JDkKIDeHg1CgpmE8eP:0RLR/sBI2xqlabkCgukqFPcVgAtSHg1D
Score
8/10
Malware Config
Signatures
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e158c4a3c9a4ab5b71890a431a7ff9af52c047fe6183f2873690666cf487c744.exe"C:\Users\Admin\AppData\Local\Temp\e158c4a3c9a4ab5b71890a431a7ff9af52c047fe6183f2873690666cf487c744.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e158c4a3c9a4ab5b71890a431a7ff9af52c047fe6183f2873690666cf487c744.exeC:\Users\Admin\AppData\Local\Temp\e158c4a3c9a4ab5b71890a431a7ff9af52c047fe6183f2873690666cf487c744.exe2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 6163⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4916 -ip 49161⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
324KB
-
Filesize
324KB