Analysis
- max time kernel
54s - max time network
74s - platform
windows10-1703_x64 - resource
win10-20220812-en - resource tags
- submitted
01/11/2022, 11:52
General
- Target 3aa9cf4a033a78e9dfddb734885bea383e2a533db89d9cbdbe4723530b24e911.exe
- Size 324KB
- Sample221101-n1ybpacegp
- SHA256 3aa9cf4a033a78e9dfddb734885bea383e2a533db89d9cbdbe4723530b24e911
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3aa9cf4a033a78e9dfddb734885bea383e2a533db89d9cbdbe4723530b24e911.exe"C:\Users\Admin\AppData\Local\Temp\3aa9cf4a033a78e9dfddb734885bea383e2a533db89d9cbdbe4723530b24e911.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3aa9cf4a033a78e9dfddb734885bea383e2a533db89d9cbdbe4723530b24e911.exeC:\Users\Admin\AppData\Local\Temp\3aa9cf4a033a78e9dfddb734885bea383e2a533db89d9cbdbe4723530b24e911.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 1523⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2668-118-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-119-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-120-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-121-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-122-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-123-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-124-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-125-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-126-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-127-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-128-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-130-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-129-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-132-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-131-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-133-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-134-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-135-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-136-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-137-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-138-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-140-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-139-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-141-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-142-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-143-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-144-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-145-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-146-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-147-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-148-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-149-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-150-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-151-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-152-0x0000000000D90000-0x0000000000DE6000-memory.dmp
memory/2668-153-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-154-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-155-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-156-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-157-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-158-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-159-0x0000000007AB0000-0x0000000007B7C000-memory.dmp
memory/2668-160-0x0000000008080000-0x000000000857E000-memory.dmp
memory/2668-161-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-162-0x0000000007C20000-0x0000000007CB2000-memory.dmp
memory/2668-163-0x00000000056F0000-0x00000000056F6000-memory.dmp
memory/2668-164-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-165-0x0000000007EC0000-0x0000000007F36000-memory.dmp
memory/2668-166-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-168-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-167-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-169-0x0000000007BA0000-0x0000000007BBE000-memory.dmp
memory/2668-170-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-171-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-175-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-174-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-173-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-172-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/2668-181-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/4784-178-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/4784-180-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/4784-179-0x00000000776D0000-0x000000007785E000-memory.dmp
memory/4784-176-0x0000000000400000-0x0000000000406000-memory.dmp