2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b

General

Target

2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe
Size

203KB
MD5

84cf33207c1372aad77b9032542c7c01
SHA1

6f88ee45ddf5c7144eb86021ab8c5a71c29374a6
SHA256

2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b
SHA512

152cbf2556e26c03a2d5eead7893cc905dff1bcb13eb070185de9d1e9c4a4eeb0acbc1d4bd10a88d3cde8dab9a97c940336d18b970db2ad57667c93c9d878173
SSDEEP

1536:mCbDzBeTNuPLE0L4dBMfE6eBEnrgQihb+3nvJyP4KNIIJ0Cnpts41E7qpSWDo5eG:pIZD3CjCb+3nRyP4KNIIV1EDWkZi+

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1736 set thread context of 1280	1736	2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe	27

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1172	1416	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1736	2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe
1736	2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1280	1736	2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe	27
PID 1736 wrote to memory of 1280	1736	2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe	27
PID 1736 wrote to memory of 1280	1736	2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe	27
PID 1736 wrote to memory of 1280	1736	2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe	27
PID 1736 wrote to memory of 1280	1736	2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe	27
PID 1736 wrote to memory of 1280	1736	2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe	27
PID 1736 wrote to memory of 1280	1736	2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe	27
PID 1736 wrote to memory of 1280	1736	2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe	27
PID 1736 wrote to memory of 1280	1736	2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe	27
PID 1736 wrote to memory of 1280	1736	2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe	27
PID 1280 wrote to memory of 1416	1280	2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe	28
PID 1280 wrote to memory of 1416	1280	2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe	28
PID 1280 wrote to memory of 1416	1280	2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe	28
PID 1280 wrote to memory of 1416	1280	2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe	28
PID 1280 wrote to memory of 1416	1280	2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe	28
PID 1280 wrote to memory of 1416	1280	2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe	28
PID 1280 wrote to memory of 1416	1280	2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe	28
PID 1280 wrote to memory of 1416	1280	2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe	28
PID 1280 wrote to memory of 1416	1280	2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe	28
PID 1416 wrote to memory of 1172	1416	explorer.exe	29
PID 1416 wrote to memory of 1172	1416	explorer.exe	29
PID 1416 wrote to memory of 1172	1416	explorer.exe	29
PID 1416 wrote to memory of 1172	1416	explorer.exe	29

C:\Users\Admin\AppData\Local\Temp\2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe
"C:\Users\Admin\AppData\Local\Temp\2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Users\Admin\AppData\Local\Temp\2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe
  "C:\Users\Admin\AppData\Local\Temp\2692b1aace68cf77262200c39986ca81ebb666ff62e2d445f2ad36d7a426a05b.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\SysWOW64\explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 232
      4⤵
      Program crash
      PID:1172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1280-65-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1280-58-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1280-59-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1280-60-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1280-55-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1280-61-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1280-56-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1416-66-0x0000000000090000-0x0000000000094000-memory.dmp

Filesize
16KB

Download
memory/1416-68-0x00000000000A0000-0x00000000000A3000-memory.dmp

Filesize
12KB

Download
memory/1416-72-0x00000000745D1000-0x00000000745D3000-memory.dmp

Filesize
8KB

Download
memory/1736-63-0x0000000000220000-0x0000000000225000-memory.dmp

Filesize
20KB

Download
memory/1736-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads