Analysis
-
max time kernel
151s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 12:36
Static task
static1
Behavioral task
behavioral1
Sample
a0363e2aff20ebc73873d953d802df26fd372bbdeaed724c3f5d885979c066ca.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a0363e2aff20ebc73873d953d802df26fd372bbdeaed724c3f5d885979c066ca.exe
Resource
win10v2004-20220812-en
General
-
Target
a0363e2aff20ebc73873d953d802df26fd372bbdeaed724c3f5d885979c066ca.exe
-
Size
1.9MB
-
MD5
6ba353f7cda6df08878ac7ea12332867
-
SHA1
8f9c982e275160acf3298c0e67b4f9322eb93264
-
SHA256
a0363e2aff20ebc73873d953d802df26fd372bbdeaed724c3f5d885979c066ca
-
SHA512
7868181fdf3195b7b7ffbf122d5e5fad5c9df621c46f3a7c89c1e8886be9f7cc5390b1b86d3c5ab8b05d8a777e7c9dfed5c18e38d2d8ef951e5aa4e4d34b1fc4
-
SSDEEP
49152:fzIjCgdSDgkvKE9RShpEEmpawuhwEYBLxpJRxnzN:f0jCgdSUkiGRSTYaw2gTz9N
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1564-132-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-135-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-134-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-136-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-137-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-139-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-141-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-143-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-145-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-147-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-149-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-151-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-153-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-155-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-157-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-159-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-161-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-163-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-165-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-167-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-169-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-171-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-173-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-175-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-178-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/1564-180-0x0000000010000000-0x000000001003D000-memory.dmp upx -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4320 1564 WerFault.exe a0363e2aff20ebc73873d953d802df26fd372bbdeaed724c3f5d885979c066ca.exe 1952 1564 WerFault.exe a0363e2aff20ebc73873d953d802df26fd372bbdeaed724c3f5d885979c066ca.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
a0363e2aff20ebc73873d953d802df26fd372bbdeaed724c3f5d885979c066ca.exepid process 1564 a0363e2aff20ebc73873d953d802df26fd372bbdeaed724c3f5d885979c066ca.exe 1564 a0363e2aff20ebc73873d953d802df26fd372bbdeaed724c3f5d885979c066ca.exe 1564 a0363e2aff20ebc73873d953d802df26fd372bbdeaed724c3f5d885979c066ca.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0363e2aff20ebc73873d953d802df26fd372bbdeaed724c3f5d885979c066ca.exe"C:\Users\Admin\AppData\Local\Temp\a0363e2aff20ebc73873d953d802df26fd372bbdeaed724c3f5d885979c066ca.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:1564 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 15042⤵
- Program crash
PID:4320 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 15242⤵
- Program crash
PID:1952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1564 -ip 15641⤵PID:4244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1564 -ip 15641⤵PID:1684
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1564-132-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-135-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-134-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-136-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-137-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-139-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-141-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-143-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-145-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-147-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-149-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-151-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-153-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-155-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-157-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-159-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-161-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-163-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-165-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-167-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-169-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-171-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-173-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-175-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-177-0x0000000000400000-0x0000000000786011-memory.dmpFilesize
3.5MB
-
memory/1564-178-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-179-0x0000000000400000-0x0000000000786011-memory.dmpFilesize
3.5MB
-
memory/1564-180-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1564-181-0x0000000000400000-0x0000000000786011-memory.dmpFilesize
3.5MB