f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 01:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665.exe
Size

216KB
MD5

0d1f2233ce4c16c9f61cc42cc97548ea
SHA1

6c1e012586ae17643aca2f5573f4ea2d171dfbba
SHA256

f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665
SHA512

72ac615bb0a4e80c191bc132ab7aa8d91f1c8722a6bb9d424bd6b856c9584967be80bd12096570989beedebb5bb88087c9aef510a0c9f83e8540a9aaa48196d9
SSDEEP

6144:FvqyHDCPtLh7asI5G7qcWmFD8zz3sNOoG:Fy2ull7aZ5CNWmFuz3sNOoG

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1612	f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665mgr.exe

Loads dropped DLL 8 IoCs

pid	Process
1544	f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665.exe
1544	f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665.exe
1612	f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665mgr.exe
1612	f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665mgr.exe
1612	f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665mgr.exe
896	WerFault.exe
896	WerFault.exe
896	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
896	1612	WerFault.exe	26

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1612	1544	f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665.exe	26
PID 1544 wrote to memory of 1612	1544	f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665.exe	26
PID 1544 wrote to memory of 1612	1544	f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665.exe	26
PID 1544 wrote to memory of 1612	1544	f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665.exe	26
PID 1544 wrote to memory of 1612	1544	f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665.exe	26
PID 1544 wrote to memory of 1612	1544	f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665.exe	26
PID 1544 wrote to memory of 1612	1544	f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665.exe	26
PID 1612 wrote to memory of 896	1612	f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665mgr.exe	27
PID 1612 wrote to memory of 896	1612	f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665mgr.exe	27
PID 1612 wrote to memory of 896	1612	f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665mgr.exe	27
PID 1612 wrote to memory of 896	1612	f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665mgr.exe	27
PID 1612 wrote to memory of 896	1612	f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665mgr.exe	27
PID 1612 wrote to memory of 896	1612	f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665mgr.exe	27
PID 1612 wrote to memory of 896	1612	f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665mgr.exe	27

C:\Users\Admin\AppData\Local\Temp\f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665.exe
"C:\Users\Admin\AppData\Local\Temp\f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Users\Admin\AppData\Local\Temp\f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665mgr.exe
  C:\Users\Admin\AppData\Local\Temp\f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665mgr.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 276
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665mgr.exe

Filesize
178KB

MD5
db98a90a075816be151bf78a39293e5b

SHA1
8afc5325246accba5adcdd830aa4ff4b101e9983

SHA256
0569be58ce08b5f17c84a3638327edf50aac1a2da68cee63c352f82545e61d66

SHA512
0793d000ad8c151aa06df3e393fdf538faf93e70e479d5c2092ddebd6437a639db27fb8792669aa433a14f07e99b546fe1f36c1bb3a47b37127530bd5252451e

Download Submit
C:\Users\Admin\AppData\Local\Temp\f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665mgr.exe

Filesize
178KB

MD5
db98a90a075816be151bf78a39293e5b

SHA1
8afc5325246accba5adcdd830aa4ff4b101e9983

SHA256
0569be58ce08b5f17c84a3638327edf50aac1a2da68cee63c352f82545e61d66

SHA512
0793d000ad8c151aa06df3e393fdf538faf93e70e479d5c2092ddebd6437a639db27fb8792669aa433a14f07e99b546fe1f36c1bb3a47b37127530bd5252451e

Download Submit
\Users\Admin\AppData\Local\Temp\f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665mgr.exe

Filesize
178KB

MD5
db98a90a075816be151bf78a39293e5b

SHA1
8afc5325246accba5adcdd830aa4ff4b101e9983

SHA256
0569be58ce08b5f17c84a3638327edf50aac1a2da68cee63c352f82545e61d66

SHA512
0793d000ad8c151aa06df3e393fdf538faf93e70e479d5c2092ddebd6437a639db27fb8792669aa433a14f07e99b546fe1f36c1bb3a47b37127530bd5252451e

Download Submit
\Users\Admin\AppData\Local\Temp\f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665mgr.exe

Filesize
178KB

MD5
db98a90a075816be151bf78a39293e5b

SHA1
8afc5325246accba5adcdd830aa4ff4b101e9983

SHA256
0569be58ce08b5f17c84a3638327edf50aac1a2da68cee63c352f82545e61d66

SHA512
0793d000ad8c151aa06df3e393fdf538faf93e70e479d5c2092ddebd6437a639db27fb8792669aa433a14f07e99b546fe1f36c1bb3a47b37127530bd5252451e

Download Submit
\Users\Admin\AppData\Local\Temp\f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665mgr.exe

Filesize
178KB

MD5
db98a90a075816be151bf78a39293e5b

SHA1
8afc5325246accba5adcdd830aa4ff4b101e9983

SHA256
0569be58ce08b5f17c84a3638327edf50aac1a2da68cee63c352f82545e61d66

SHA512
0793d000ad8c151aa06df3e393fdf538faf93e70e479d5c2092ddebd6437a639db27fb8792669aa433a14f07e99b546fe1f36c1bb3a47b37127530bd5252451e

Download Submit
\Users\Admin\AppData\Local\Temp\f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665mgr.exe

Filesize
178KB

MD5
db98a90a075816be151bf78a39293e5b

SHA1
8afc5325246accba5adcdd830aa4ff4b101e9983

SHA256
0569be58ce08b5f17c84a3638327edf50aac1a2da68cee63c352f82545e61d66

SHA512
0793d000ad8c151aa06df3e393fdf538faf93e70e479d5c2092ddebd6437a639db27fb8792669aa433a14f07e99b546fe1f36c1bb3a47b37127530bd5252451e

Download Submit
\Users\Admin\AppData\Local\Temp\f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665mgr.exe

Filesize
178KB

MD5
db98a90a075816be151bf78a39293e5b

SHA1
8afc5325246accba5adcdd830aa4ff4b101e9983

SHA256
0569be58ce08b5f17c84a3638327edf50aac1a2da68cee63c352f82545e61d66

SHA512
0793d000ad8c151aa06df3e393fdf538faf93e70e479d5c2092ddebd6437a639db27fb8792669aa433a14f07e99b546fe1f36c1bb3a47b37127530bd5252451e

Download Submit
\Users\Admin\AppData\Local\Temp\f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665mgr.exe

Filesize
178KB

MD5
db98a90a075816be151bf78a39293e5b

SHA1
8afc5325246accba5adcdd830aa4ff4b101e9983

SHA256
0569be58ce08b5f17c84a3638327edf50aac1a2da68cee63c352f82545e61d66

SHA512
0793d000ad8c151aa06df3e393fdf538faf93e70e479d5c2092ddebd6437a639db27fb8792669aa433a14f07e99b546fe1f36c1bb3a47b37127530bd5252451e

Download Submit
\Users\Admin\AppData\Local\Temp\f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665mgr.exe

Filesize
178KB

MD5
db98a90a075816be151bf78a39293e5b

SHA1
8afc5325246accba5adcdd830aa4ff4b101e9983

SHA256
0569be58ce08b5f17c84a3638327edf50aac1a2da68cee63c352f82545e61d66

SHA512
0793d000ad8c151aa06df3e393fdf538faf93e70e479d5c2092ddebd6437a639db27fb8792669aa433a14f07e99b546fe1f36c1bb3a47b37127530bd5252451e

Download Submit
\Users\Admin\AppData\Local\Temp\f38bc252937834573b16dfe81f736a187d45bdecadb747e11537e6b017ab4665mgr.exe

Filesize
178KB

MD5
db98a90a075816be151bf78a39293e5b

SHA1
8afc5325246accba5adcdd830aa4ff4b101e9983

SHA256
0569be58ce08b5f17c84a3638327edf50aac1a2da68cee63c352f82545e61d66

SHA512
0793d000ad8c151aa06df3e393fdf538faf93e70e479d5c2092ddebd6437a639db27fb8792669aa433a14f07e99b546fe1f36c1bb3a47b37127530bd5252451e

Download Submit
memory/1544-59-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1544-54-0x0000000075681000-0x0000000075683000-memory.dmp

Filesize
8KB

Download
memory/1612-69-0x0000000000230000-0x00000000002DC000-memory.dmp

Filesize
688KB

Download
memory/1612-70-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads