Analysis
-
max time kernel
166s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 17:41
Static task
static1
Behavioral task
behavioral1
Sample
d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe
Resource
win10v2004-20221111-en
General
-
Target
d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe
-
Size
375KB
-
MD5
507829d4d619db588bc19dc88e2ce7bc
-
SHA1
d2224ec1e4dd778bdbc082d3f6370056b7f841dd
-
SHA256
d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f
-
SHA512
7362edf6b4819afe941f52eed54879bf60f4202f1e4ea41c6abd42c80a7e7504aeaaa49d29e9b48db67da44fb9c4506bad39884e974137ebce28ad5cfbb22c6f
-
SSDEEP
6144:E93TqoTetsvlJ4DGBdu2YpJ3qOe4yufYspgrGQVUAt5OCHmQRGRCnpGq:EFlT88z4yBU/3qO5yx1rGrAt5OCHjgCt
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5108-133-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral2/memory/5108-135-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral2/memory/5108-134-0x0000000010000000-0x000000001031C000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1620 set thread context of 3544 1620 d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe 84 -
Program crash 1 IoCs
pid pid_target Process procid_target 776 3544 WerFault.exe 84 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1620 d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe 1620 d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1620 wrote to memory of 5108 1620 d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe 82 PID 1620 wrote to memory of 5108 1620 d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe 82 PID 1620 wrote to memory of 5108 1620 d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe 82 PID 1620 wrote to memory of 5108 1620 d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe 82 PID 1620 wrote to memory of 5108 1620 d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe 82 PID 1620 wrote to memory of 5108 1620 d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe 82 PID 1620 wrote to memory of 1536 1620 d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe 83 PID 1620 wrote to memory of 1536 1620 d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe 83 PID 1620 wrote to memory of 1536 1620 d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe 83 PID 1620 wrote to memory of 1536 1620 d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe 83 PID 1620 wrote to memory of 1536 1620 d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe 83 PID 1620 wrote to memory of 1536 1620 d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe 83 PID 1620 wrote to memory of 3544 1620 d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe 84 PID 1620 wrote to memory of 3544 1620 d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe 84 PID 1620 wrote to memory of 3544 1620 d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe 84 PID 1620 wrote to memory of 3544 1620 d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe 84 PID 1620 wrote to memory of 3544 1620 d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe 84 PID 1620 wrote to memory of 3544 1620 d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe 84 PID 1620 wrote to memory of 3544 1620 d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe 84 PID 1620 wrote to memory of 3544 1620 d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe"C:\Users\Admin\AppData\Local\Temp\d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:5108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:1536
-
-
C:\Users\Admin\AppData\Local\Temp\d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exeC:\Users\Admin\AppData\Local\Temp\d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe2⤵PID:3544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 1883⤵
- Program crash
PID:776
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3544 -ip 35441⤵PID:1352