Analysis
-
max time kernel
96s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 09:05
Static task
static1
Behavioral task
behavioral1
Sample
add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe
Resource
win10v2004-20220812-en
General
-
Target
add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe
-
Size
124KB
-
MD5
ddd6095557b713606b9bb737e3587c8e
-
SHA1
a9f2338e12866d07c53d43cb444bd209fc88194a
-
SHA256
add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab
-
SHA512
b5166d9d889bd5ec8d8b368c22061bf3b3f8af451d0978721e11af5c63234482e2b149966cfa713dfc83b3e72d74fea44366da70c220531748bdf58b147e0abe
-
SSDEEP
1536:q8BTSkthADhUi4rvybK7ExEjPmOQQylVMdImKOA+Ndg9UJgZWA97ir:rBv/ADiiXK7ExvOQTVMu1D+/gj97U
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1868-135-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral2/memory/1868-137-0x0000000000400000-0x0000000000419000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exedescription pid process target process PID 4684 set thread context of 1868 4684 add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4900 1868 WerFault.exe add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exepid process 4684 add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exedescription pid process target process PID 4684 wrote to memory of 1868 4684 add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe PID 4684 wrote to memory of 1868 4684 add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe PID 4684 wrote to memory of 1868 4684 add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe PID 4684 wrote to memory of 1868 4684 add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe PID 4684 wrote to memory of 1868 4684 add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe PID 4684 wrote to memory of 1868 4684 add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe PID 4684 wrote to memory of 1868 4684 add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe"C:\Users\Admin\AppData\Local\Temp\add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe"C:\Users\Admin\AppData\Local\Temp\add512c2b95bf1d103e482610a61d7daf857cc2a3f091609a612c7c19750dbab.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 2363⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1868 -ip 18681⤵