646d1eeb6a212bfa708028a8e436982380bd68c46993dc44c26702f8ced25926

Analysis

max time kernel
53s
max time network
60s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
01/11/2022, 00:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

646d1eeb6a212bfa708028a8e436982380bd68c46993dc44c26702f8ced25926.exe
Size

322KB
MD5

b845555932cd087f408465ba4d7ab4d6
SHA1

d82a0e8ec31e6e7019d7daf76662621b1a3be574
SHA256

646d1eeb6a212bfa708028a8e436982380bd68c46993dc44c26702f8ced25926
SHA512

ced8987309ea89b12673db364599ad6cc7acf24a8053c55d42a2111011dfd4e3f8040a769ecbef2fad5cf3fc9d6acd355150053f10694f13f6be03bf993558e7
SSDEEP

6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2752 set thread context of 4304	2752	646d1eeb6a212bfa708028a8e436982380bd68c46993dc44c26702f8ced25926.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4884	4304	WerFault.exe	67

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 3548	2752	646d1eeb6a212bfa708028a8e436982380bd68c46993dc44c26702f8ced25926.exe	66
PID 2752 wrote to memory of 3548	2752	646d1eeb6a212bfa708028a8e436982380bd68c46993dc44c26702f8ced25926.exe	66
PID 2752 wrote to memory of 3548	2752	646d1eeb6a212bfa708028a8e436982380bd68c46993dc44c26702f8ced25926.exe	66
PID 2752 wrote to memory of 4304	2752	646d1eeb6a212bfa708028a8e436982380bd68c46993dc44c26702f8ced25926.exe	67
PID 2752 wrote to memory of 4304	2752	646d1eeb6a212bfa708028a8e436982380bd68c46993dc44c26702f8ced25926.exe	67
PID 2752 wrote to memory of 4304	2752	646d1eeb6a212bfa708028a8e436982380bd68c46993dc44c26702f8ced25926.exe	67
PID 2752 wrote to memory of 4304	2752	646d1eeb6a212bfa708028a8e436982380bd68c46993dc44c26702f8ced25926.exe	67
PID 2752 wrote to memory of 4304	2752	646d1eeb6a212bfa708028a8e436982380bd68c46993dc44c26702f8ced25926.exe	67
PID 2752 wrote to memory of 4304	2752	646d1eeb6a212bfa708028a8e436982380bd68c46993dc44c26702f8ced25926.exe	67
PID 2752 wrote to memory of 4304	2752	646d1eeb6a212bfa708028a8e436982380bd68c46993dc44c26702f8ced25926.exe	67
PID 2752 wrote to memory of 4304	2752	646d1eeb6a212bfa708028a8e436982380bd68c46993dc44c26702f8ced25926.exe	67
PID 2752 wrote to memory of 4304	2752	646d1eeb6a212bfa708028a8e436982380bd68c46993dc44c26702f8ced25926.exe	67

C:\Users\Admin\AppData\Local\Temp\646d1eeb6a212bfa708028a8e436982380bd68c46993dc44c26702f8ced25926.exe
"C:\Users\Admin\AppData\Local\Temp\646d1eeb6a212bfa708028a8e436982380bd68c46993dc44c26702f8ced25926.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Users\Admin\AppData\Local\Temp\646d1eeb6a212bfa708028a8e436982380bd68c46993dc44c26702f8ced25926.exe
  C:\Users\Admin\AppData\Local\Temp\646d1eeb6a212bfa708028a8e436982380bd68c46993dc44c26702f8ced25926.exe
  2⤵
  PID:3548
- C:\Users\Admin\AppData\Local\Temp\646d1eeb6a212bfa708028a8e436982380bd68c46993dc44c26702f8ced25926.exe
  C:\Users\Admin\AppData\Local\Temp\646d1eeb6a212bfa708028a8e436982380bd68c46993dc44c26702f8ced25926.exe
  2⤵
  PID:4304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 24
    3⤵
    - Program crash
    PID:4884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2752-120-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-121-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-122-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-123-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-124-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-125-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-126-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-127-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-128-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-130-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-131-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-133-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-132-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-134-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-129-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-135-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-136-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-137-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-138-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-139-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-140-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-141-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-142-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-143-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-144-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-145-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-146-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-147-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-148-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-149-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-150-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-151-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-152-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-153-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-154-0x0000000000300000-0x0000000000356000-memory.dmp

Filesize
344KB

Download
memory/2752-155-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-156-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-157-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-158-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-159-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-160-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-161-0x0000000004C40000-0x0000000004D0C000-memory.dmp

Filesize
816KB

Download
memory/2752-162-0x00000000075B0000-0x0000000007AAE000-memory.dmp

Filesize
5.0MB

Download
memory/2752-163-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-164-0x0000000007150000-0x00000000071E2000-memory.dmp

Filesize
584KB

Download
memory/2752-165-0x00000000070C0000-0x00000000070C6000-memory.dmp

Filesize
24KB

Download
memory/2752-166-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-167-0x0000000007470000-0x00000000074E6000-memory.dmp

Filesize
472KB

Download
memory/2752-168-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-169-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-170-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-171-0x0000000007110000-0x000000000712E000-memory.dmp

Filesize
120KB

Download
memory/2752-172-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-173-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-174-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-175-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-177-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-176-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-180-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4304-178-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads