d4d480f3d060b2ff098a3760af91086444b270e9c21d9be8d27510092296c195

Analysis

max time kernel
39s
max time network
80s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 16:57

Target

d4d480f3d060b2ff098a3760af91086444b270e9c21d9be8d27510092296c195.exe
Size

3.7MB
MD5

443129f38943d70a67cab143c6c06a02
SHA1

4697c23f629150282648cad66cf103c9efea9dba
SHA256

d4d480f3d060b2ff098a3760af91086444b270e9c21d9be8d27510092296c195
SHA512

55190639d97dc5f9c656ca3852e253ec56b2cc7842310a2f58093b5279e6e189992afe5e6458dc112aaa84210cdd5b0abdb4f1db9ed558dd22e2a43dc40b34bc
SSDEEP

98304:RDGnkRWN+Ci067DeL2iUZz9ZdvyjfXMNgvHNIekdwLBWd5:gN+Cw62Nrv0fXMNetIPwL85

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

d4d480f3d060b2ff098a3760af91086444b270e9c21d9be8d27510092296c195.exe

pid process

1920 d4d480f3d060b2ff098a3760af91086444b270e9c21d9be8d27510092296c195.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1232 1920 WerFault.exe d4d480f3d060b2ff098a3760af91086444b270e9c21d9be8d27510092296c195.exe

pid	pid_target	process	target process
1232	1920	WerFault.exe	d4d480f3d060b2ff098a3760af91086444b270e9c21d9be8d27510092296c195.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

d4d480f3d060b2ff098a3760af91086444b270e9c21d9be8d27510092296c195.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d4d480f3d060b2ff098a3760af91086444b270e9c21d9be8d27510092296c195.exe

description	pid	process	target process
PID 1920 wrote to memory of 1232	1920	d4d480f3d060b2ff098a3760af91086444b270e9c21d9be8d27510092296c195.exe	WerFault.exe
PID 1920 wrote to memory of 1232	1920	d4d480f3d060b2ff098a3760af91086444b270e9c21d9be8d27510092296c195.exe	WerFault.exe
PID 1920 wrote to memory of 1232	1920	d4d480f3d060b2ff098a3760af91086444b270e9c21d9be8d27510092296c195.exe	WerFault.exe
PID 1920 wrote to memory of 1232	1920	d4d480f3d060b2ff098a3760af91086444b270e9c21d9be8d27510092296c195.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\d4d480f3d060b2ff098a3760af91086444b270e9c21d9be8d27510092296c195.exe
"C:\Users\Admin\AppData\Local\Temp\d4d480f3d060b2ff098a3760af91086444b270e9c21d9be8d27510092296c195.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 460
  2⤵
  - Program crash
  PID:1232

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\11278442481\LZMA.dll

Filesize
67KB

MD5
d0f2416807f04c559e6394a0a4c7f1d1

SHA1
7df43ffa3716156d282b1e37d12dd1122f0a762c

SHA256
0fe6a869cf220769a058f8d281f272ef72669e3587673e52b53f3f9650dcf1fc

SHA512
8199c967ad813216f2ef3094a7614c9ccc95d35a817fc685cb7823f36cc97f0279bddd0ec0bb8f07ee2445476aaea35548516841ee9cde53a8be395515457799

Download Submit
memory/1232-56-0x0000000000000000-mapping.dmp

Download
memory/1920-54-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download