Analysis

  • max time kernel
    166s
  • max time network
    181s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/12/2022, 17:41

General

  • Target

    d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe

  • Size

    375KB

  • MD5

    507829d4d619db588bc19dc88e2ce7bc

  • SHA1

    d2224ec1e4dd778bdbc082d3f6370056b7f841dd

  • SHA256

    d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f

  • SHA512

    7362edf6b4819afe941f52eed54879bf60f4202f1e4ea41c6abd42c80a7e7504aeaaa49d29e9b48db67da44fb9c4506bad39884e974137ebce28ad5cfbb22c6f

  • SSDEEP

    6144:E93TqoTetsvlJ4DGBdu2YpJ3qOe4yufYspgrGQVUAt5OCHmQRGRCnpGq:EFlT88z4yBU/3qO5yx1rGrAt5OCHjgCt

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe
    "C:\Users\Admin\AppData\Local\Temp\d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      2⤵
        PID:5108
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        2⤵
          PID:1536
        • C:\Users\Admin\AppData\Local\Temp\d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe
          C:\Users\Admin\AppData\Local\Temp\d6d43e518ad11fee5d48d00d148dee779a08641e168eaace79f29fb836b7608f.exe
          2⤵
            PID:3544
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 188
              3⤵
              • Program crash
              PID:776
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3544 -ip 3544
          1⤵
            PID:1352

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/5108-133-0x0000000010000000-0x000000001031C000-memory.dmp

            Filesize

            3.1MB

          • memory/5108-135-0x0000000010000000-0x000000001031C000-memory.dmp

            Filesize

            3.1MB

          • memory/5108-134-0x0000000010000000-0x000000001031C000-memory.dmp

            Filesize

            3.1MB