7b06b55321fc80a3c0047a9a158e37bc1383ad8294940e1b0c8628aa2fa01c44

Analysis

max time kernel
138s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b06b55321fc80a3c0047a9a158e37bc1383ad8294940e1b0c8628aa2fa01c44.exe
Size

203KB
MD5

ec31c7b2f853827ccd78c573265f9c3f
SHA1

c006b12716ef9fce677aad9ab99984492adc3fd2
SHA256

7b06b55321fc80a3c0047a9a158e37bc1383ad8294940e1b0c8628aa2fa01c44
SHA512

9df0a12462ea635efc9487bab993292cfd5fa1d2eda87cfaae37a3f00a6401012886ecc616bf9d8c8b3a77ec808da709a92099617ea230fe3ef69337469a0e75
SSDEEP

6144:TXD8eWfctN54ehNrXTYIE3QcFmms3yKimtSp:TXD8eW0tnYIEAec3M

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2256	QQlive.exe

Loads dropped DLL 1 IoCs

pid	Process
2256	QQlive.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5016	2256	WerFault.exe	80
1368	2256	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 2256	792	7b06b55321fc80a3c0047a9a158e37bc1383ad8294940e1b0c8628aa2fa01c44.exe	80
PID 792 wrote to memory of 2256	792	7b06b55321fc80a3c0047a9a158e37bc1383ad8294940e1b0c8628aa2fa01c44.exe	80
PID 792 wrote to memory of 2256	792	7b06b55321fc80a3c0047a9a158e37bc1383ad8294940e1b0c8628aa2fa01c44.exe	80

C:\Users\Admin\AppData\Local\Temp\7b06b55321fc80a3c0047a9a158e37bc1383ad8294940e1b0c8628aa2fa01c44.exe
"C:\Users\Admin\AppData\Local\Temp\7b06b55321fc80a3c0047a9a158e37bc1383ad8294940e1b0c8628aa2fa01c44.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:792
- C:\ProgramData\Microsoft\Windows\QQlive.exe
  C:\ProgramData\Microsoft\Windows\QQlive.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 380
    3⤵
    - Program crash
    PID:5016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 364
    3⤵
    - Program crash
    PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 2256 -ip 2256
1⤵
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2256 -ip 2256
1⤵
PID:1260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Common\Utility.dll

Filesize
112KB

MD5
d6dd81f976dbf793df322f4ae779f0dd

SHA1
051c8ad764b561eea932573e1bd796fae87c2cf7

SHA256
6a31be8366fba742e3995f088c1a0a4abff6e3aeb70a04cdb175b54c36ad7508

SHA512
5b52cf250a8b41717556ae0915511010effbc2f49c355872a5925239b2df59a18982df6fd0501a67cbd7d07b1f742cd5f1f7e8e319ff7e3405a6a4a94fd4f02d

Download Submit
C:\ProgramData\Microsoft\Windows\Common\Utility.dll

Filesize
112KB

MD5
d6dd81f976dbf793df322f4ae779f0dd

SHA1
051c8ad764b561eea932573e1bd796fae87c2cf7

SHA256
6a31be8366fba742e3995f088c1a0a4abff6e3aeb70a04cdb175b54c36ad7508

SHA512
5b52cf250a8b41717556ae0915511010effbc2f49c355872a5925239b2df59a18982df6fd0501a67cbd7d07b1f742cd5f1f7e8e319ff7e3405a6a4a94fd4f02d

Download Submit
C:\ProgramData\Microsoft\Windows\QQlive.exe

Filesize
14KB

MD5
5e95e6131ff0e79ad5df107db915760c

SHA1
5c3370b98798aab405c724250ab543291fed2fb2

SHA256
059ceeede58369f41c5090cc2eb264098ad0a0fd41b14a166e743de41e56f7cf

SHA512
07c6cb9faa40b0db3f80bb952a1a4cacdb97025a4c96add3fb67a692c6e8ef4fe19f0eb9727fa019431abd7892f9053662fcf61bf21df65a0630f0af563dda32

Download Submit
C:\ProgramData\Microsoft\Windows\QQlive.exe

Filesize
14KB

MD5
5e95e6131ff0e79ad5df107db915760c

SHA1
5c3370b98798aab405c724250ab543291fed2fb2

SHA256
059ceeede58369f41c5090cc2eb264098ad0a0fd41b14a166e743de41e56f7cf

SHA512
07c6cb9faa40b0db3f80bb952a1a4cacdb97025a4c96add3fb67a692c6e8ef4fe19f0eb9727fa019431abd7892f9053662fcf61bf21df65a0630f0af563dda32

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads