Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 23:48
General
-
Target
48766f0f696466a281092791cb00e898813712efd7dbdd9fa6845ffd5ac2e93e.exe
-
Size
31KB
-
MD5
43986e935b2c3877fa539b1bd29491e1
-
SHA1
2f4f7d2caa4850288b00bd79391ac26ca0c79283
-
SHA256
48766f0f696466a281092791cb00e898813712efd7dbdd9fa6845ffd5ac2e93e
-
SHA512
5abf03a9dc0a5b6ff6aa1dc3d8fb13d644b3dc20cf0244fe3aa598ff8fcda6a56e891cc5d2da35240c59f08a245e5b3fe07f1137f500800b9856a81ac90f2a38
-
SSDEEP
768:Zk07DzTB+iSfTeiZBVWShwEEnG0L7rTLu8fqUe:CCEOEEG8rTa8m
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\48766f0f696466a281092791cb00e898813712efd7dbdd9fa6845ffd5ac2e93e.exe"C:\Users\Admin\AppData\Local\Temp\48766f0f696466a281092791cb00e898813712efd7dbdd9fa6845ffd5ac2e93e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 5803⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1800 -ip 18001⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
-
Filesize
76KB
-
Filesize
36KB
-
Filesize
28KB