fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942

Analysis

max time kernel
43s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 10:31

Target

fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe
Size

1.5MB
MD5

6fa0f13914affbe3f7540a2426bb5d19
SHA1

686d72dac9e3f46185dc7a844639b5ec7d53adea
SHA256

fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942
SHA512

cb070b30131434e22db994c1c845d1e5c3332a9310177e16c6f6cdd8a836bd6d8c4bf88f190f2bfee9004dd5e9b7270f27026265344701ea1db74f4a7898a8bd
SSDEEP

49152:M9MJrnLf+6humwV0oFfK50mmQeZyMyKwJD:M9MVrta7I5HQMowJD

Score

7^/10

discovery

Loads dropped DLL 1 IoCs

pid	Process
864	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1168	864	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
864	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe
864	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe
864	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
864	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe
864	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe
864	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe
864	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 1168	864	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe	28
PID 864 wrote to memory of 1168	864	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe	28
PID 864 wrote to memory of 1168	864	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe	28
PID 864 wrote to memory of 1168	864	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe	28
PID 864 wrote to memory of 1168	864	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe	28
PID 864 wrote to memory of 1168	864	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe	28
PID 864 wrote to memory of 1168	864	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe	28

C:\Users\Admin\AppData\Local\Temp\fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe
"C:\Users\Admin\AppData\Local\Temp\fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 672
  2⤵
  - Program crash
  PID:1168

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\1124155747942\LZMA.dll

Filesize
67KB

MD5
d0f2416807f04c559e6394a0a4c7f1d1

SHA1
7df43ffa3716156d282b1e37d12dd1122f0a762c

SHA256
0fe6a869cf220769a058f8d281f272ef72669e3587673e52b53f3f9650dcf1fc

SHA512
8199c967ad813216f2ef3094a7614c9ccc95d35a817fc685cb7823f36cc97f0279bddd0ec0bb8f07ee2445476aaea35548516841ee9cde53a8be395515457799

Download Submit
memory/864-54-0x0000000076B51000-0x0000000076B53000-memory.dmp

Filesize
8KB

Download