Analysis

  • max time kernel
    132s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 06:46

General

  • Target

    Processing.Pdf____________________________________________________________.exe

  • Size

    474KB

  • MD5

    7e3556dc9dc56ef11af7276854f404c8

  • SHA1

    26f676d0a6a0057fe6aa35a0d025c478d8e05741

  • SHA256

    efd29f1af6c5e828bc4c1c980ab22ddc0a89c0c7813bf8075b8b8943edc19e5c

  • SHA512

    d2a5b2c2ed9f628d2c85bac66eeb6af7d19d1b5baed8577acf83701d08b377c47ff3f00a5e590b96136cfab887c15d62622f54a56cc3dd23a507b985fd288bb2

  • SSDEEP

    6144:dipL4qsxpzEOqcQLO8eNpOsYZqQJgOFATNFadd5G/c9FhkZJh4NCf0oxAOQPTRpD:d6UZbzfZmswqfNFQDuJhEJxR8L0

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Processing.Pdf____________________________________________________________.exe
    "C:\Users\Admin\AppData\Local\Temp\Processing.Pdf____________________________________________________________.exe"
    1⤵
    • Suspicious use of NtCreateThreadExHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:4740
    • C:\Users\Admin\AppData\Local\Temp\Processing.Pdf____________________________________________________________.exe
      "C:\Users\Admin\AppData\Local\Temp\Processing.Pdf____________________________________________________________.exe"
      2⤵
        PID:4052
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 8
          3⤵
          • Program crash
          PID:4544
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4052 -ip 4052
      1⤵
        PID:3128

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4052-132-0x0000000000000000-mapping.dmp