Analysis
-
max time kernel
205s -
max time network
208s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
24-11-2022 08:38
General
-
Target
9074299a303536d90b0ba1c9c2d0f3a2d8feff8f3709b0d13b210eaeb74ad4d5.exe
-
Size
394KB
-
MD5
2e791137ec776be9e448531bbe82ff11
-
SHA1
f1f3564805f85a09a6b89ced88df0a02a756758a
-
SHA256
9074299a303536d90b0ba1c9c2d0f3a2d8feff8f3709b0d13b210eaeb74ad4d5
-
SHA512
2ee4463950fbe2c593ed28ae7aa0adb840cc3961401f7007579a234a63f976e130d2a3dee6fb2350d0f277c1f1788aac3f94233ab8f05614e6d3aec3d95ac047
-
SSDEEP
12288:a1VlArRr2hamQIMVpEMQ5jGl15KaNKLRGp:a1Vk92QIk6FGl13N0R
Score
8/10
Malware Config
Signatures
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9074299a303536d90b0ba1c9c2d0f3a2d8feff8f3709b0d13b210eaeb74ad4d5.exe"C:\Users\Admin\AppData\Local\Temp\9074299a303536d90b0ba1c9c2d0f3a2d8feff8f3709b0d13b210eaeb74ad4d5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 176 -s 123⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 176 -ip 1761⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
316KB
-
Filesize
544KB
-
Filesize
268KB
-
Filesize
544KB