4fc2ebf460eed4261a201ebb125d27cdc78fb952161a2aa1fda1336986f885ea

Analysis

max time kernel
145s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fc2ebf460eed4261a201ebb125d27cdc78fb952161a2aa1fda1336986f885ea.exe
Size

707KB
MD5

426a9731f03d0ab4b5b4c79075790635
SHA1

d1822a3588a83fc5d190466fbfc58543e5b45bfa
SHA256

4fc2ebf460eed4261a201ebb125d27cdc78fb952161a2aa1fda1336986f885ea
SHA512

6508497c127b62afd2ed7bda0a3ced80bb4bb7e3ef37167f8764c8bb5810057eb8db0a75f5f9ab21a959beaf2de9899acac1c5edf9a978d71faaafa97edf9eda
SSDEEP

12288:h2Jh6RufcsaiWH6HfLU+Octf2ic+g/6thKg:h2+RCE6/LU+lRcHCJ

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2148	5084	WerFault.exe	66
2012	5084	WerFault.exe	66

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\usd.document\shell\open\command	4fc2ebf460eed4261a201ebb125d27cdc78fb952161a2aa1fda1336986f885ea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\usd.document\shell	4fc2ebf460eed4261a201ebb125d27cdc78fb952161a2aa1fda1336986f885ea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\usd.document\shell\open	4fc2ebf460eed4261a201ebb125d27cdc78fb952161a2aa1fda1336986f885ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\usd.document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4FC2EB~1.EXE \" %1\""	4fc2ebf460eed4261a201ebb125d27cdc78fb952161a2aa1fda1336986f885ea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.usd\ShellNew	4fc2ebf460eed4261a201ebb125d27cdc78fb952161a2aa1fda1336986f885ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\usd.document\ = "usd.document"	4fc2ebf460eed4261a201ebb125d27cdc78fb952161a2aa1fda1336986f885ea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\usd.document\DefaultIcon	4fc2ebf460eed4261a201ebb125d27cdc78fb952161a2aa1fda1336986f885ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\usd.document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4FC2EB~1.EXE,0"	4fc2ebf460eed4261a201ebb125d27cdc78fb952161a2aa1fda1336986f885ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.usd\ShellNew\ = "Null File"	4fc2ebf460eed4261a201ebb125d27cdc78fb952161a2aa1fda1336986f885ea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\usd.document	4fc2ebf460eed4261a201ebb125d27cdc78fb952161a2aa1fda1336986f885ea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.usd	4fc2ebf460eed4261a201ebb125d27cdc78fb952161a2aa1fda1336986f885ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.usd\ = "usd.document"	4fc2ebf460eed4261a201ebb125d27cdc78fb952161a2aa1fda1336986f885ea.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5084	4fc2ebf460eed4261a201ebb125d27cdc78fb952161a2aa1fda1336986f885ea.exe
5084	4fc2ebf460eed4261a201ebb125d27cdc78fb952161a2aa1fda1336986f885ea.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 2148	5084	4fc2ebf460eed4261a201ebb125d27cdc78fb952161a2aa1fda1336986f885ea.exe	82
PID 5084 wrote to memory of 2148	5084	4fc2ebf460eed4261a201ebb125d27cdc78fb952161a2aa1fda1336986f885ea.exe	82
PID 5084 wrote to memory of 2148	5084	4fc2ebf460eed4261a201ebb125d27cdc78fb952161a2aa1fda1336986f885ea.exe	82

C:\Users\Admin\AppData\Local\Temp\4fc2ebf460eed4261a201ebb125d27cdc78fb952161a2aa1fda1336986f885ea.exe
"C:\Users\Admin\AppData\Local\Temp\4fc2ebf460eed4261a201ebb125d27cdc78fb952161a2aa1fda1336986f885ea.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 1004
  2⤵
  - Program crash
  PID:2148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 1004
  2⤵
  - Program crash
  PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5084 -ip 5084
1⤵
PID:1308

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads