Behavioral Report

Analysis

max time kernel
112s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 04:00

Sharing

Copy URL

Twitter E-mail

Report Files Registry Network Processes Mutex Misc

General

Target

ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
Size

199KB
MD5

0f281b373ea675941571b49ada22628f
SHA1

19169e9fbc81ac7aeda5b3f6c1a1f742412519b3
SHA256

ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c
SHA512

6d06db45aee072951a5c35930ccd9f697595c5427ed56be02d96012bb71277b15863e4075c27c181c9cbd1f42056381cd0790d693c70817ba47a2ba6bb5cc737
SSDEEP

6144:r0Mpl/l/mN0rFYnLp1n3vawvxhPgj/jQj:hELLzn3vak3gnq

Score

3^/10

Malware Config

Signatures

Program crash ⋅ 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1712 1428 WerFault.exe ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe

pid	pid_target	process	target process
1712	1428	WerFault.exe	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe

Suspicious use of SetWindowsHookAW ⋅ 64 IoCs

Processes:

ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe

pid	process
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe
1428	ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe

C:\Users\Admin\AppData\Local\Temp\ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe

"C:\Users\Admin\AppData\Local\Temp\ad4867a256b66212c709c8308cfb1d3f827705eb7e6c21e2fa1ce43963f9351c.exe"

Suspicious use of SetWindowsHookAW

PID:1428

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 464

Program crash

PID:1712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1428 -ip 1428

PID:1792

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

memory/1428-132-0x00000000021B0000-0x00000000021C9000-memory.dmp

Download