a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52

Analysis

max time kernel
63s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
Size

104KB
MD5

58e75feba55cb3d2811d808e8f90b363
SHA1

2743048b179b298af4bed38794d6721f9091faf6
SHA256

a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52
SHA512

0b9ef5bac06af319572cdd464fff13c0b57ec9448269cad8661a91a356b62be095bc691d3c5b06c044c712bf9c27f419c84f28676b77f033dded742d017b3e5a
SSDEEP

1536:uTMC2yPOsg4bfeEdNW+FXyXUjp7j3CI3ZeZ5qX8k:ul7Pp5LWYYa7jyI3ZW5qMk

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe

description	pid	process	target process
PID 3704 set thread context of 384	3704	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2952 384 WerFault.exe a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe

pid process

3704 a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe

pid	pid_target	process	target process
2952	384	WerFault.exe	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe

pid	process
3704	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe

description	pid	process	target process
PID 3704 wrote to memory of 384	3704	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
PID 3704 wrote to memory of 384	3704	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
PID 3704 wrote to memory of 384	3704	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
PID 3704 wrote to memory of 384	3704	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
PID 3704 wrote to memory of 384	3704	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
PID 3704 wrote to memory of 384	3704	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
PID 3704 wrote to memory of 384	3704	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
PID 3704 wrote to memory of 384	3704	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
PID 3704 wrote to memory of 384	3704	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe	a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe

C:\Users\Admin\AppData\Local\Temp\a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
"C:\Users\Admin\AppData\Local\Temp\a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3704

C:\Users\Admin\AppData\Local\Temp\a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe
"C:\Users\Admin\AppData\Local\Temp\a873ab7c1e0b36adf4ed56433512413bb2e9ec61278b19ecfb1b795a362a9b52.exe"
2⤵
PID:384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 660
3⤵
- Program crash
PID:2952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 384 -ip 384
1⤵
PID:2064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/384-135-0x0000000000000000-mapping.dmp

Download
memory/384-136-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/384-139-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/384-140-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/384-141-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3704-133-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3704-138-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download