Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 16:08
Static task
static1
Behavioral task
behavioral1
Sample
a6ffd97ca5d47f2251a53ccd3ab891a9fec5b7d0f316b4c11e7d88f19765b1b4.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a6ffd97ca5d47f2251a53ccd3ab891a9fec5b7d0f316b4c11e7d88f19765b1b4.exe
Resource
win10v2004-20220812-en
General
-
Target
a6ffd97ca5d47f2251a53ccd3ab891a9fec5b7d0f316b4c11e7d88f19765b1b4.exe
-
Size
3.7MB
-
MD5
27b75158dcfeba6b3419bdbb15397584
-
SHA1
8a135c4fc3fa7e06bf29537f9cb0298cc2f1c1de
-
SHA256
a6ffd97ca5d47f2251a53ccd3ab891a9fec5b7d0f316b4c11e7d88f19765b1b4
-
SHA512
eb9acc530d9c20dc26a00489572fe5b21075181f5f25d6598ebd5292aef5bbce9c2dc89fac04201ea7ce5c5faec545e44c02e54356ae6dfda7d2f70255a930b3
-
SSDEEP
49152:YI2A2+xup+pRTSHO1c6R7heQLqPqW7SdZ8iyTgyfw91m0tfSl8TtVlkQb9Hmv3IS:FneShqwhb/lkHv3IzT
Malware Config
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1724 set thread context of 820 1724 a6ffd97ca5d47f2251a53ccd3ab891a9fec5b7d0f316b4c11e7d88f19765b1b4.exe 28 -
Program crash 1 IoCs
pid pid_target Process procid_target 652 1724 WerFault.exe 26 -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1724 wrote to memory of 820 1724 a6ffd97ca5d47f2251a53ccd3ab891a9fec5b7d0f316b4c11e7d88f19765b1b4.exe 28 PID 1724 wrote to memory of 820 1724 a6ffd97ca5d47f2251a53ccd3ab891a9fec5b7d0f316b4c11e7d88f19765b1b4.exe 28 PID 1724 wrote to memory of 820 1724 a6ffd97ca5d47f2251a53ccd3ab891a9fec5b7d0f316b4c11e7d88f19765b1b4.exe 28 PID 1724 wrote to memory of 820 1724 a6ffd97ca5d47f2251a53ccd3ab891a9fec5b7d0f316b4c11e7d88f19765b1b4.exe 28 PID 1724 wrote to memory of 820 1724 a6ffd97ca5d47f2251a53ccd3ab891a9fec5b7d0f316b4c11e7d88f19765b1b4.exe 28 PID 1724 wrote to memory of 820 1724 a6ffd97ca5d47f2251a53ccd3ab891a9fec5b7d0f316b4c11e7d88f19765b1b4.exe 28 PID 1724 wrote to memory of 652 1724 a6ffd97ca5d47f2251a53ccd3ab891a9fec5b7d0f316b4c11e7d88f19765b1b4.exe 29 PID 1724 wrote to memory of 652 1724 a6ffd97ca5d47f2251a53ccd3ab891a9fec5b7d0f316b4c11e7d88f19765b1b4.exe 29 PID 1724 wrote to memory of 652 1724 a6ffd97ca5d47f2251a53ccd3ab891a9fec5b7d0f316b4c11e7d88f19765b1b4.exe 29 PID 1724 wrote to memory of 652 1724 a6ffd97ca5d47f2251a53ccd3ab891a9fec5b7d0f316b4c11e7d88f19765b1b4.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6ffd97ca5d47f2251a53ccd3ab891a9fec5b7d0f316b4c11e7d88f19765b1b4.exe"C:\Users\Admin\AppData\Local\Temp\a6ffd97ca5d47f2251a53ccd3ab891a9fec5b7d0f316b4c11e7d88f19765b1b4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 362⤵
- Program crash
PID:652
-