Overview

overview

10

Static

static

a53451540b...65.exe

windows7-x64

10

a53451540b...65.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2022, 10:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    a53451540bfb1d4afbd7dac085a1a477f05e5a1053759b2ff334689fd41a2365.exe

  • Size

    544KB

  • MD5

    0904697ca1ae36a4a807de91c54ab362

  • SHA1

    b5fb89e10e01b56d3d30f32a0f64f47686d6a700

  • SHA256

    a53451540bfb1d4afbd7dac085a1a477f05e5a1053759b2ff334689fd41a2365

  • SHA512

    5c3b81050b437e97bf37a45dd5f8b199e8bd9790b2a7bfaf170bb7c88283e97184f8d473322e3780c2c21186341f12d2f24e48e742ba8bdcb791640bca820c04

  • SSDEEP

    12288:2ATYvlEoC2Fqhes6eDuUlJX0KQ6KbbqRWDqH:2gclEmAhes6WO6KKwGH

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a53451540bfb1d4afbd7dac085a1a477f05e5a1053759b2ff334689fd41a2365.exe
    "C:\Users\Admin\AppData\Local\Temp\a53451540bfb1d4afbd7dac085a1a477f05e5a1053759b2ff334689fd41a2365.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5024
    • C:\Users\Admin\AppData\Local\Temp\a53451540bfb1d4afbd7dac085a1a477f05e5a1053759b2ff334689fd41a2365mgr.exe
      C:\Users\Admin\AppData\Local\Temp\a53451540bfb1d4afbd7dac085a1a477f05e5a1053759b2ff334689fd41a2365mgr.exe
      2⤵
      • Executes dropped EXE
      PID:5000
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 268
        3⤵
        • Program crash
        PID:3448
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5000 -ip 5000
    1⤵
      PID:3388

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\a53451540bfb1d4afbd7dac085a1a477f05e5a1053759b2ff334689fd41a2365mgr.exe
            Filesize

            226KB

            MD5

            0443f220bbe647a9f012ef8be7826915

            SHA1

            a4d35c05941e01bfda5e6aebf8696bbe1cbe57eb

            SHA256

            943d8c1c80dda309f3b9b2af6d0cc311b00acabc0b9016c37359e5c20aa4ab90

            SHA512

            a09035c929aace492303ba04bc00add212569d1d6dc37f41b814ebb295cb749e0cb7543ceea79c8a39f31e8e14a6bbd9519fac34d42070ed031b911adfebebd9

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\a53451540bfb1d4afbd7dac085a1a477f05e5a1053759b2ff334689fd41a2365mgr.exe
            Filesize

            226KB

            MD5

            0443f220bbe647a9f012ef8be7826915

            SHA1

            a4d35c05941e01bfda5e6aebf8696bbe1cbe57eb

            SHA256

            943d8c1c80dda309f3b9b2af6d0cc311b00acabc0b9016c37359e5c20aa4ab90

            SHA512

            a09035c929aace492303ba04bc00add212569d1d6dc37f41b814ebb295cb749e0cb7543ceea79c8a39f31e8e14a6bbd9519fac34d42070ed031b911adfebebd9

            Download Submit

          • memory/5000-137-0x0000000000400000-0x00000000004B7000-memory.dmp

            Filesize

            732KB

            Download

          • memory/5000-138-0x0000000000600000-0x0000000000608000-memory.dmp

            Filesize

            32KB

            Download

          • memory/5024-133-0x0000000000400000-0x000000000049C000-memory.dmp

            Filesize

            624KB

            Download

          • memory/5024-136-0x0000000000400000-0x000000000049C000-memory.dmp

            Filesize

            624KB

            Download