504aba9ffc85b963c92b2725c54b2f16e8dca913b5dbe2b7d75786eee3692a38 | Triage

Analysis

max time kernel
14s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 09:08

Sharing

Report Analysis Logs

General

Target

©ɱ/083.exe
Size

47KB
MD5

43ece23bc3643cb8f9f00236be372d10
SHA1

f4dff3deea262093342630d9cb9a1b6559e0b61b
SHA256

ce221ef17253fea274d68f688f401b4887bc8b5c516fa73601d08d0cb21850b3
SHA512

781d0f7fe3a33880c15098fed1d6abf57a875e8d3825fad690fe72dc78f31b04132bb4e18661e682bf33409db3240181ce2198decd1754ddde2868c127d822bd
SSDEEP

384:D2ciGXkW059C8YpAx7r6+e9Pfqbn12S3B/qiIpQYemv/I9Ve3WxSTfS7UIn:q7n3C8YaxCha52Sx/l00tSu4

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral22/memory/2484-132-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral22/memory/2484-133-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3508 2484 WerFault.exe 083.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

083.exe

pid process

2484 083.exe

C:\Users\Admin\AppData\Local\Temp\©ɱ\083.exe
"C:\Users\Admin\AppData\Local\Temp\©ɱ\083.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 464
2⤵
- Program crash
PID:3508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2484 -ip 2484
1⤵
PID:2400

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2484-132-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2484-133-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download