a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0

Analysis

max time kernel
180s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe
Size

114KB
MD5

e2e6674fc6ae6302ce8959b6686e1271
SHA1

d414eaa34b5c2956b5ff7a397a18413dd6570a9e
SHA256

a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0
SHA512

d912c971df40caf8994b9c298c872b3b6cfb01f34b18e9b2205ee6e38a8176f0a22e2a4e7a12675fa04a53ae21b2523498a9d3eab748d9d8882ad53edaa03850
SSDEEP

3072:MkvGoWRDcYIBs8QrkOWCXwY7vKHL8QOPnI+iH2uapAnD:zeoWbIBsrrQ87A8zhbAD

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe

description	pid	process	target process
PID 3816 set thread context of 4224	3816	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe

description	pid	process	target process
PID 3816 wrote to memory of 4224	3816	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe
PID 3816 wrote to memory of 4224	3816	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe
PID 3816 wrote to memory of 4224	3816	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe
PID 3816 wrote to memory of 4224	3816	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe
PID 3816 wrote to memory of 4224	3816	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe
PID 3816 wrote to memory of 4224	3816	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe
PID 3816 wrote to memory of 4224	3816	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe
PID 3816 wrote to memory of 4224	3816	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe
PID 3816 wrote to memory of 4224	3816	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe

C:\Users\Admin\AppData\Local\Temp\a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe
"C:\Users\Admin\AppData\Local\Temp\a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3816

C:\Users\Admin\AppData\Local\Temp\a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe
"C:\Users\Admin\AppData\Local\Temp\a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe"
2⤵
PID:4224

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -lc NDIS NDIS-20221123-1110.dmp
1⤵
PID:940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3816-132-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3816-136-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4224-133-0x0000000000000000-mapping.dmp

Download
memory/4224-134-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4224-137-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download