165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbf

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbf.exe
Size

279KB
MD5

122714b0bf4174bc0562d0f7250e3a8e
SHA1

7f93a7fc252c28c54b68d604d6c26fb002ec8fa9
SHA256

165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbf
SHA512

aaa00f8c753be18c114eda6543bdb48603add27b216c2d8ffdb51ebbd76cc42a7d30266b3986d8997a1bcef6b949c40fcf4acb91428f90aeb0f0447e9db276b5
SSDEEP

1536:QCTUJs8ZFjaIvfMeSfO8k2ul15qyQbgd54vRvLTYq17N0imcDW2RS/VwVNuU5YjN:QBlvcul15qyZ7+NZlhSGV/EGlkRiODtd

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1728	165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbfmgr.exe

Loads dropped DLL 9 IoCs

pid	Process
1848	165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbf.exe
1848	165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbf.exe
960	WerFault.exe
960	WerFault.exe
960	WerFault.exe
960	WerFault.exe
960	WerFault.exe
960	WerFault.exe
960	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
960	1728	WerFault.exe	28

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 1728	1848	165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbf.exe	28
PID 1848 wrote to memory of 1728	1848	165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbf.exe	28
PID 1848 wrote to memory of 1728	1848	165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbf.exe	28
PID 1848 wrote to memory of 1728	1848	165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbf.exe	28
PID 1728 wrote to memory of 960	1728	165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbfmgr.exe	29
PID 1728 wrote to memory of 960	1728	165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbfmgr.exe	29
PID 1728 wrote to memory of 960	1728	165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbfmgr.exe	29
PID 1728 wrote to memory of 960	1728	165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbfmgr.exe	29

C:\Users\Admin\AppData\Local\Temp\165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbf.exe
"C:\Users\Admin\AppData\Local\Temp\165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbfmgr.exe
  C:\Users\Admin\AppData\Local\Temp\165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbfmgr.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 128
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbfmgr.exe

Filesize
140KB

MD5
5a0bf5cd4324e0c29307c452d6ee3bfb

SHA1
8b78c259585a3c0b3f96f6abc88b85ba8f2e2dc5

SHA256
2f6feefd669f66edec11215a7c430ea78d8dd3aeed754e29922815db77c024b3

SHA512
c3b771438d786134f5aabf6bd6fd33e64184bbf93a54cc0e1d54904f8b5971ac2e34acbed64ed691e2014d645aec067f1489749d08e5483589f753cc7ba62650

Download Submit
\Users\Admin\AppData\Local\Temp\165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbfmgr.exe

Filesize
140KB

MD5
5a0bf5cd4324e0c29307c452d6ee3bfb

SHA1
8b78c259585a3c0b3f96f6abc88b85ba8f2e2dc5

SHA256
2f6feefd669f66edec11215a7c430ea78d8dd3aeed754e29922815db77c024b3

SHA512
c3b771438d786134f5aabf6bd6fd33e64184bbf93a54cc0e1d54904f8b5971ac2e34acbed64ed691e2014d645aec067f1489749d08e5483589f753cc7ba62650

Download Submit
\Users\Admin\AppData\Local\Temp\165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbfmgr.exe

Filesize
140KB

MD5
5a0bf5cd4324e0c29307c452d6ee3bfb

SHA1
8b78c259585a3c0b3f96f6abc88b85ba8f2e2dc5

SHA256
2f6feefd669f66edec11215a7c430ea78d8dd3aeed754e29922815db77c024b3

SHA512
c3b771438d786134f5aabf6bd6fd33e64184bbf93a54cc0e1d54904f8b5971ac2e34acbed64ed691e2014d645aec067f1489749d08e5483589f753cc7ba62650

Download Submit
\Users\Admin\AppData\Local\Temp\165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbfmgr.exe

Filesize
140KB

MD5
5a0bf5cd4324e0c29307c452d6ee3bfb

SHA1
8b78c259585a3c0b3f96f6abc88b85ba8f2e2dc5

SHA256
2f6feefd669f66edec11215a7c430ea78d8dd3aeed754e29922815db77c024b3

SHA512
c3b771438d786134f5aabf6bd6fd33e64184bbf93a54cc0e1d54904f8b5971ac2e34acbed64ed691e2014d645aec067f1489749d08e5483589f753cc7ba62650

Download Submit
\Users\Admin\AppData\Local\Temp\165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbfmgr.exe

Filesize
140KB

MD5
5a0bf5cd4324e0c29307c452d6ee3bfb

SHA1
8b78c259585a3c0b3f96f6abc88b85ba8f2e2dc5

SHA256
2f6feefd669f66edec11215a7c430ea78d8dd3aeed754e29922815db77c024b3

SHA512
c3b771438d786134f5aabf6bd6fd33e64184bbf93a54cc0e1d54904f8b5971ac2e34acbed64ed691e2014d645aec067f1489749d08e5483589f753cc7ba62650

Download Submit
\Users\Admin\AppData\Local\Temp\165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbfmgr.exe

Filesize
140KB

MD5
5a0bf5cd4324e0c29307c452d6ee3bfb

SHA1
8b78c259585a3c0b3f96f6abc88b85ba8f2e2dc5

SHA256
2f6feefd669f66edec11215a7c430ea78d8dd3aeed754e29922815db77c024b3

SHA512
c3b771438d786134f5aabf6bd6fd33e64184bbf93a54cc0e1d54904f8b5971ac2e34acbed64ed691e2014d645aec067f1489749d08e5483589f753cc7ba62650

Download Submit
\Users\Admin\AppData\Local\Temp\165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbfmgr.exe

Filesize
140KB

MD5
5a0bf5cd4324e0c29307c452d6ee3bfb

SHA1
8b78c259585a3c0b3f96f6abc88b85ba8f2e2dc5

SHA256
2f6feefd669f66edec11215a7c430ea78d8dd3aeed754e29922815db77c024b3

SHA512
c3b771438d786134f5aabf6bd6fd33e64184bbf93a54cc0e1d54904f8b5971ac2e34acbed64ed691e2014d645aec067f1489749d08e5483589f753cc7ba62650

Download Submit
\Users\Admin\AppData\Local\Temp\165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbfmgr.exe

Filesize
140KB

MD5
5a0bf5cd4324e0c29307c452d6ee3bfb

SHA1
8b78c259585a3c0b3f96f6abc88b85ba8f2e2dc5

SHA256
2f6feefd669f66edec11215a7c430ea78d8dd3aeed754e29922815db77c024b3

SHA512
c3b771438d786134f5aabf6bd6fd33e64184bbf93a54cc0e1d54904f8b5971ac2e34acbed64ed691e2014d645aec067f1489749d08e5483589f753cc7ba62650

Download Submit
\Users\Admin\AppData\Local\Temp\165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbfmgr.exe

Filesize
140KB

MD5
5a0bf5cd4324e0c29307c452d6ee3bfb

SHA1
8b78c259585a3c0b3f96f6abc88b85ba8f2e2dc5

SHA256
2f6feefd669f66edec11215a7c430ea78d8dd3aeed754e29922815db77c024b3

SHA512
c3b771438d786134f5aabf6bd6fd33e64184bbf93a54cc0e1d54904f8b5971ac2e34acbed64ed691e2014d645aec067f1489749d08e5483589f753cc7ba62650

Download Submit
\Users\Admin\AppData\Local\Temp\165a8774c413f830272748a6a2b3d3212478d78e5794925b93ed584d60980fbfmgr.exe

Filesize
140KB

MD5
5a0bf5cd4324e0c29307c452d6ee3bfb

SHA1
8b78c259585a3c0b3f96f6abc88b85ba8f2e2dc5

SHA256
2f6feefd669f66edec11215a7c430ea78d8dd3aeed754e29922815db77c024b3

SHA512
c3b771438d786134f5aabf6bd6fd33e64184bbf93a54cc0e1d54904f8b5971ac2e34acbed64ed691e2014d645aec067f1489749d08e5483589f753cc7ba62650

Download Submit
memory/1848-59-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1848-54-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads