897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979

General

Target

897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe
Size

45KB
MD5

bf83f96bd78a43fa3abc36ab55d61b5f
SHA1

3468945288128014b236b47fd55f35757688eaa3
SHA256

897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979
SHA512

bcad6f9ae4c1facb02f5c33399e27427d4834d5cc0266e9fc540b11fcfb6ce945a4a194c0488b33914447ed1a4fe32cca08b2bf7971e50c7147bdc1bc4195bff
SSDEEP

768:hCCqjLQSY6Hna6pVA4jOOMOcokE9CZDkYneJldC9cIheVI6kcsIB:ICq/Q5ma4wLOcokqwkgeLdCi2eV0I

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe

description	pid	process	target process
PID 948 set thread context of 988	948	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1900 948 WerFault.exe 897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe

pid	pid_target	process	target process
1900	948	WerFault.exe	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe

pid	process
988	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe
988	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe

description	pid	process	target process
PID 948 wrote to memory of 988	948	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe
PID 948 wrote to memory of 988	948	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe
PID 948 wrote to memory of 988	948	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe
PID 948 wrote to memory of 988	948	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe
PID 948 wrote to memory of 988	948	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe
PID 948 wrote to memory of 988	948	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe
PID 988 wrote to memory of 1388	988	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe	Explorer.EXE
PID 948 wrote to memory of 1900	948	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe	WerFault.exe
PID 948 wrote to memory of 1900	948	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe	WerFault.exe
PID 948 wrote to memory of 1900	948	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe	WerFault.exe
PID 948 wrote to memory of 1900	948	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe	WerFault.exe
PID 988 wrote to memory of 1388	988	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe	Explorer.EXE
PID 988 wrote to memory of 1388	988	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe	Explorer.EXE
PID 988 wrote to memory of 1388	988	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe	Explorer.EXE
PID 988 wrote to memory of 1388	988	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe	Explorer.EXE
PID 988 wrote to memory of 1388	988	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1388

C:\Users\Admin\AppData\Local\Temp\897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe
"C:\Users\Admin\AppData\Local\Temp\897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:948

C:\Users\Admin\AppData\Local\Temp\897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe
C:\Users\Admin\AppData\Local\Temp\897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 92
3⤵
- Program crash
PID:1900

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/988-54-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/988-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/988-57-0x00000000004074ED-mapping.dmp

Download
memory/988-59-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/988-60-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/988-62-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/988-63-0x0000000000020000-0x0000000000031000-memory.dmp

Filesize
68KB

Download
memory/1388-64-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/1900-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads