Analysis

  • max time kernel
    72s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 11:14

General

  • Target

    a95f11395fffa13f99167ab7c19d615c4f62f5904627c0348273d6af45ef1a2c.exe

  • Size

    963KB

  • MD5

    04a57e4f00bfe41f8b83868a31cd8b11

  • SHA1

    44cf492ceb9b546e7a1316874040ce34a9f36a28

  • SHA256

    a95f11395fffa13f99167ab7c19d615c4f62f5904627c0348273d6af45ef1a2c

  • SHA512

    3170f9dd4a85c5e50be8338c72c421c016ba0be2805f9ebdbf9cf2968e52cab0c3c2387f00aa2a5179af5b2bc42869db25ed073763e12876d0b3291ce7d990ff

  • SSDEEP

    12288:VqIq7yNed06uo7Wri1iZeWKCn+vJendUbNH14A+YuNI01pkZQ+:Vfq7yNed0BFn+vJhNItb1yZQ+

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a95f11395fffa13f99167ab7c19d615c4f62f5904627c0348273d6af45ef1a2c.exe
    "C:\Users\Admin\AppData\Local\Temp\a95f11395fffa13f99167ab7c19d615c4f62f5904627c0348273d6af45ef1a2c.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3168
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 268
      2⤵
      • Program crash
      PID:1584
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3168 -ip 3168
    1⤵
      PID:5008

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3168-132-0x0000000000400000-0x0000000000599000-memory.dmp

      Filesize

      1.6MB

    • memory/3168-133-0x0000000000400000-0x0000000000599000-memory.dmp

      Filesize

      1.6MB

    • memory/3168-134-0x0000000000400000-0x0000000000599000-memory.dmp

      Filesize

      1.6MB

    • memory/3168-135-0x0000000000400000-0x0000000000599000-memory.dmp

      Filesize

      1.6MB

    • memory/3168-136-0x0000000000400000-0x0000000000599000-memory.dmp

      Filesize

      1.6MB

    • memory/3168-137-0x0000000000400000-0x0000000000599000-memory.dmp

      Filesize

      1.6MB