0f61e4c12e7b1adaef470477741d36eb115d8ec9fb6ad827e6db4104b2d9ca85

Analysis

max time kernel
144s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
977aef45b0a6ca6b0a0f048e2367bfd9.exe
Size 1008KB
Sample221122-lpcjqshb23
SHA256 0f61e4c12e7b1adaef470477741d36eb115d8ec9fb6ad827e6db4104b2d9ca85
MD5 977aef45b0a6ca6b0a0f048e2367bfd9
SHA1 7acb1fda1e09f506a0e7b147257b7ca3a1e27da5
SHA512 892315a488773dfc75c9f382954d8a852033754996b8fef24cf6ebc39aec1a2920bffce12319856a2b420c110a5f44fd96f757d187547450dc050403486a84d9
SSDEEP 24576:Z8TqvAmyf8CuVR9Et3y5/NsqF42X3FYJBmO2lp4WAP158QXOmC:Z2KAJxyRKy5uqGP2fLe1ZfC
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 6 IoCs

flow	pid	Process
5	3940	rundll32.exe
14	3940	rundll32.exe
23	3940	rundll32.exe
32	3940	rundll32.exe
38	3940	rundll32.exe
42	3940	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
3940	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3184	4508	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 3940	4508	977aef45b0a6ca6b0a0f048e2367bfd9.exe	85
PID 4508 wrote to memory of 3940	4508	977aef45b0a6ca6b0a0f048e2367bfd9.exe	85
PID 4508 wrote to memory of 3940	4508	977aef45b0a6ca6b0a0f048e2367bfd9.exe	85

C:\Users\Admin\AppData\Local\Temp\977aef45b0a6ca6b0a0f048e2367bfd9.exe
"C:\Users\Admin\AppData\Local\Temp\977aef45b0a6ca6b0a0f048e2367bfd9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Wuwedteata.tmp",Tiuqiiueaur
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:3940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 528
  2⤵
  - Program crash
  PID:3184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4508 -ip 4508
1⤵
PID:5048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Wuwedteata.tmp

Path C:\Users\Admin\AppData\Local\Temp\Wuwedteata.tmp
Size 752KB
SHA256 6ecc725eab418e27d8fa2f1031fce6bc119d677b8d72e0447050a87489e8e0ca
MD5 ad4fe6dd11eca5f7254e0e00ed47d984
SHA1 e809de0322d74dd4642f215f46f22b3a9b7caa21
SHA512 d09f4f9a94f34fe1a6f5fe78ec32e91026fe07263183d4d41c4a51cfa7ee5fbc1b38d2ebeda20a717a2a730af011d73d113decb3ae2fe9db50530c095cf33ea3
SSDEEP 12288:zfSxtWGq0esNiHPcc92qLSl6Tw3he78O48BG7QvUaDkndA+OmV8YqOgFkVd4FGJC:z6x4ff3Sxg5/R5ou7/P795pJc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Wuwedteata.tmp

Path C:\Users\Admin\AppData\Local\Temp\Wuwedteata.tmp
Size 752KB
SHA256 6ecc725eab418e27d8fa2f1031fce6bc119d677b8d72e0447050a87489e8e0ca
MD5 ad4fe6dd11eca5f7254e0e00ed47d984
SHA1 e809de0322d74dd4642f215f46f22b3a9b7caa21
SHA512 d09f4f9a94f34fe1a6f5fe78ec32e91026fe07263183d4d41c4a51cfa7ee5fbc1b38d2ebeda20a717a2a730af011d73d113decb3ae2fe9db50530c095cf33ea3
SSDEEP 12288:zfSxtWGq0esNiHPcc92qLSl6Tw3he78O48BG7QvUaDkndA+OmV8YqOgFkVd4FGJC:z6x4ff3Sxg5/R5ou7/P795pJc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4508-132-0x00000000045F8000-0x00000000046D6000-memory.dmp

Download

memory/4508-133-0x00000000046E0000-0x0000000004801000-memory.dmp

Download

memory/4508-137-0x0000000000400000-0x00000000028B6000-memory.dmp

Download

memory/4508-138-0x00000000046E0000-0x0000000004801000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads