5f02d11f87d53b8e02eb1a943c553c969dc80f57bad64fedd842b5607109a141 | Triage

Analysis

max time kernel
194s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:05

Sharing

Report Analysis Logs

General

Target

EXEPackager/样本/《银狐》片头.exe
Size

3.4MB
MD5

67ff7135cda8b9314deb666b14256c7c
SHA1

25dc3c7c0281cdc4a55743e6c3faa3d6babff031
SHA256

90a181a6a771a88cd38179d4a60cea2a3a88eed946aed6aa1a7838d0428f6643
SHA512

9dcf81ce26d6f2d9bcb15a1c4ccc9ae0e21d181f7813fe4ff5c04b8995312a849b20830a6379d436843be069894347fb246229b4a735243b0949482fda7c9577
SSDEEP

98304:6F/2+PLt0YwGMf0e3JpZElQ2Fh4vr40mhOBe2r:61VPL2GMfH5ElHFh4v806S

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2564 3076 WerFault.exe 《银狐》片头.exe

C:\Users\Admin\AppData\Local\Temp\EXEPackager\样本\《银狐》片头.exe
"C:\Users\Admin\AppData\Local\Temp\EXEPackager\样本\《银狐》片头.exe"
1⤵
PID:3076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 752
2⤵
- Program crash
PID:2564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3076 -ip 3076
1⤵
PID:224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads