Analysis
-
max time kernel
93s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 11:51
Static task
static1
Behavioral task
behavioral1
Sample
7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe
Resource
win10v2004-20220812-en
General
-
Target
7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe
-
Size
478KB
-
MD5
3346650620e7a2161f761bb9d1958220
-
SHA1
1c7e265e0a9c7cacc4f073f506279907d02ed6fb
-
SHA256
7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee
-
SHA512
a7f1ad5b86b89428518d6452d63e27fc2a26f30cb869e65ce1e5acb7b484f4ea0fb9bc4108655d80d9d13bcdc56527cfffd86b2f60a1bfd573dfa5694bde9d6a
-
SSDEEP
6144:bicL4qwxpzEaqcQMfx/o9JAKcQrdSTfXE1Sp2XyWOfevI0Fzm12qlw:bnUlbz3H/o99cOSTf0S2Xyk1f8w
Malware Config
Signatures
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exepid process 1264 7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exedescription pid process target process PID 1264 set thread context of 1376 1264 7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe 7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2136 1376 WerFault.exe 7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exedescription pid process target process PID 1264 wrote to memory of 1376 1264 7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe 7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe PID 1264 wrote to memory of 1376 1264 7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe 7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe PID 1264 wrote to memory of 1376 1264 7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe 7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe PID 1264 wrote to memory of 1376 1264 7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe 7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe PID 1264 wrote to memory of 1376 1264 7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe 7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe PID 1264 wrote to memory of 1376 1264 7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe 7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe PID 1264 wrote to memory of 1376 1264 7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe 7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe PID 1264 wrote to memory of 1376 1264 7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe 7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe PID 1264 wrote to memory of 1376 1264 7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe 7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe PID 1264 wrote to memory of 1376 1264 7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe 7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe"C:\Users\Admin\AppData\Local\Temp\7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe"1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe"C:\Users\Admin\AppData\Local\Temp\7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 83⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1376 -ip 13761⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1376-132-0x0000000000000000-mapping.dmp