285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3

Analysis

max time kernel
28s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe
Size

79KB
MD5

509b74366cc18ee7ed622a215461adb3
SHA1

a20829269f400fd17d9cad48ffa8c5faf9bb7036
SHA256

285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3
SHA512

2fd2dd231d3b344482ad786ffda4331ae7b9534dc751b19158ef93cc7b916d3a19cfc04300666bb28fecd9acac9048adc08b2ef8db19565941dc74d002e24d33
SSDEEP

1536:Y85tt2bdXJ0qO/cRApm1kTYXEb8uyPG29zHW7u+y1s:vF2bZJ05/+ApLs0bOPG2VHW7u1y

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe

description	pid	process	target process
PID 1976 set thread context of 1708	1976	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1316 1976 WerFault.exe 285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe

pid	pid_target	process	target process
1316	1976	WerFault.exe	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe

pid	process
1708	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe
1708	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe

description	pid	process	target process
PID 1976 wrote to memory of 1708	1976	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe
PID 1976 wrote to memory of 1708	1976	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe
PID 1976 wrote to memory of 1708	1976	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe
PID 1976 wrote to memory of 1708	1976	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe
PID 1976 wrote to memory of 1708	1976	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe
PID 1976 wrote to memory of 1708	1976	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe
PID 1976 wrote to memory of 1316	1976	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe	WerFault.exe
PID 1976 wrote to memory of 1316	1976	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe	WerFault.exe
PID 1976 wrote to memory of 1316	1976	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe	WerFault.exe
PID 1976 wrote to memory of 1316	1976	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe	WerFault.exe
PID 1708 wrote to memory of 1400	1708	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe	Explorer.EXE
PID 1708 wrote to memory of 1400	1708	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe	Explorer.EXE
PID 1708 wrote to memory of 1400	1708	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe	Explorer.EXE
PID 1708 wrote to memory of 1400	1708	285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe	Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe
"C:\Users\Admin\AppData\Local\Temp\285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1976

C:\Users\Admin\AppData\Local\Temp\285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe
"C:\Users\Admin\AppData\Local\Temp\285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe" "a…êers\Admin\AppData\Local\Temp\285403872dedc555c9667dda3c48174d47bd16c1a28dcd62822b1551e6b6eba3.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 216
2⤵
- Program crash
PID:1316

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1400

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1316-59-0x0000000000000000-mapping.dmp

Download
memory/1400-61-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1708-56-0x0000000000407C89-mapping.dmp

Download
memory/1708-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1708-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1708-64-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1708-65-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1976-54-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads