a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52

General

Target

a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
Size

104KB
MD5

58e75feba55cb3d2811d808e8f90b363
SHA1

2743048b179b298af4bed38794d6721f9091faf6
SHA256

a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52
SHA512

0b9ef5bac06af319572cdd464fff13c0b57ec9448269cad8661a91a356b62be095bc691d3c5b06c044c712bf9c27f419c84f28676b77f033dded742d017b3e5a
SSDEEP

1536:uTMC2yPOsg4bfeEdNW+FXyXUjp7j3CI3ZeZ5qX8k:ul7Pp5LWYYa7jyI3ZW5qMk

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe

description	pid	process	target process
PID 884 set thread context of 1728	884	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

900 1728 WerFault.exe a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe

pid process

884 a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe

pid	pid_target	process	target process
900	1728	WerFault.exe	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe

pid	process
884	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exea873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe

description	pid	process	target process
PID 884 wrote to memory of 1728	884	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
PID 884 wrote to memory of 1728	884	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
PID 884 wrote to memory of 1728	884	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
PID 884 wrote to memory of 1728	884	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
PID 884 wrote to memory of 1728	884	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
PID 884 wrote to memory of 1728	884	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
PID 884 wrote to memory of 1728	884	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
PID 884 wrote to memory of 1728	884	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
PID 884 wrote to memory of 1728	884	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
PID 884 wrote to memory of 1728	884	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
PID 1728 wrote to memory of 900	1728	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	WerFault.exe
PID 1728 wrote to memory of 900	1728	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	WerFault.exe
PID 1728 wrote to memory of 900	1728	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	WerFault.exe
PID 1728 wrote to memory of 900	1728	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
"C:\Users\Admin\AppData\Local\Temp\a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:884

C:\Users\Admin\AppData\Local\Temp\a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
"C:\Users\Admin\AppData\Local\Temp\a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 228
3⤵
- Program crash
PID:900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/884-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/884-68-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/900-71-0x0000000000000000-mapping.dmp

Download
memory/1728-60-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1728-62-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1728-63-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1728-64-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1728-65-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1728-66-0x00000000004068F8-mapping.dmp

Download
memory/1728-58-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1728-69-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1728-70-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1728-57-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing