e86ea00b8657f13783fc4af7d6b50a4224a1c958d75ed8ee55fc5618f66d1180

General

Target

e86ea00b8657f13783fc4af7d6b50a4224a1c958d75ed8ee55fc5618f66d1180.exe
Size

312KB
MD5

7488b17fee1748bb0ad8348070ed27bd
SHA1

f172f98bf19ee2c8b028e180838a996e3926b468
SHA256

e86ea00b8657f13783fc4af7d6b50a4224a1c958d75ed8ee55fc5618f66d1180
SHA512

4134a1438148ea7bb30c11af6eaf43553e5264b62d411eadb5a995ec0b23b70f566af965428aba701e8344d422117b1470cd2363808d95ba387b12d817fd918a
SSDEEP

6144:TJjak4Doz0FgXtREl1GyF4xCElRC3yAussJOfjizhKt/+:TJ6oz/RuGC4o6CiUbB/+

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3604 set thread context of 4280	3604	e86ea00b8657f13783fc4af7d6b50a4224a1c958d75ed8ee55fc5618f66d1180.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2800	4280	WerFault.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3604	e86ea00b8657f13783fc4af7d6b50a4224a1c958d75ed8ee55fc5618f66d1180.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 4280	3604	e86ea00b8657f13783fc4af7d6b50a4224a1c958d75ed8ee55fc5618f66d1180.exe	82
PID 3604 wrote to memory of 4280	3604	e86ea00b8657f13783fc4af7d6b50a4224a1c958d75ed8ee55fc5618f66d1180.exe	82
PID 3604 wrote to memory of 4280	3604	e86ea00b8657f13783fc4af7d6b50a4224a1c958d75ed8ee55fc5618f66d1180.exe	82
PID 3604 wrote to memory of 4280	3604	e86ea00b8657f13783fc4af7d6b50a4224a1c958d75ed8ee55fc5618f66d1180.exe	82
PID 3604 wrote to memory of 4280	3604	e86ea00b8657f13783fc4af7d6b50a4224a1c958d75ed8ee55fc5618f66d1180.exe	82
PID 3604 wrote to memory of 4280	3604	e86ea00b8657f13783fc4af7d6b50a4224a1c958d75ed8ee55fc5618f66d1180.exe	82
PID 3604 wrote to memory of 4280	3604	e86ea00b8657f13783fc4af7d6b50a4224a1c958d75ed8ee55fc5618f66d1180.exe	82
PID 3604 wrote to memory of 4280	3604	e86ea00b8657f13783fc4af7d6b50a4224a1c958d75ed8ee55fc5618f66d1180.exe	82
PID 3604 wrote to memory of 4280	3604	e86ea00b8657f13783fc4af7d6b50a4224a1c958d75ed8ee55fc5618f66d1180.exe	82
PID 3604 wrote to memory of 4280	3604	e86ea00b8657f13783fc4af7d6b50a4224a1c958d75ed8ee55fc5618f66d1180.exe	82
PID 3604 wrote to memory of 4280	3604	e86ea00b8657f13783fc4af7d6b50a4224a1c958d75ed8ee55fc5618f66d1180.exe	82
PID 3604 wrote to memory of 4280	3604	e86ea00b8657f13783fc4af7d6b50a4224a1c958d75ed8ee55fc5618f66d1180.exe	82
PID 3604 wrote to memory of 4280	3604	e86ea00b8657f13783fc4af7d6b50a4224a1c958d75ed8ee55fc5618f66d1180.exe	82
PID 3604 wrote to memory of 4280	3604	e86ea00b8657f13783fc4af7d6b50a4224a1c958d75ed8ee55fc5618f66d1180.exe	82

C:\Users\Admin\AppData\Local\Temp\e86ea00b8657f13783fc4af7d6b50a4224a1c958d75ed8ee55fc5618f66d1180.exe
"C:\Users\Admin\AppData\Local\Temp\e86ea00b8657f13783fc4af7d6b50a4224a1c958d75ed8ee55fc5618f66d1180.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Users\Admin\AppData\Local\Temp\e86ea00b8657f13783fc4af7d6b50a4224a1c958d75ed8ee55fc5618f66d1180.exe
  C:\Users\Admin\AppData\Local\Temp\e86ea00b8657f13783fc4af7d6b50a4224a1c958d75ed8ee55fc5618f66d1180.exe
  2⤵
  PID:4280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 364
    3⤵
    - Program crash
    PID:2800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4280 -ip 4280
1⤵
PID:2936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3604-139-0x0000000000530000-0x0000000000534000-memory.dmp

Filesize
16KB

Download
memory/3604-132-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3604-141-0x0000000002200000-0x0000000002239000-memory.dmp

Filesize
228KB

Download
memory/3604-138-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4280-146-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4280-153-0x000000000040C000-0x000000000040D000-memory.dmp

Filesize
4KB

Download
memory/4280-140-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4280-136-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4280-142-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4280-143-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4280-145-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4280-147-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4280-148-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4280-149-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4280-151-0x000000000040C000-0x000000000040D000-memory.dmp

Filesize
4KB

Download
memory/4280-150-0x000000000040C000-0x000000000040D000-memory.dmp

Filesize
4KB

Download
memory/4280-137-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4280-152-0x000000000040C000-0x000000000040D000-memory.dmp

Filesize
4KB

Download
memory/4280-154-0x000000000040C000-0x000000000040D000-memory.dmp

Filesize
4KB

Download
memory/4280-156-0x000000000040C000-0x000000000040D000-memory.dmp

Filesize
4KB

Download
memory/4280-155-0x000000000040C000-0x000000000040D000-memory.dmp

Filesize
4KB

Download
memory/4280-157-0x000000000040C000-0x000000000040D000-memory.dmp

Filesize
4KB

Download
memory/4280-159-0x000000000040C000-0x000000000040D000-memory.dmp

Filesize
4KB

Download
memory/4280-158-0x000000000040C000-0x000000000040D000-memory.dmp

Filesize
4KB

Download
memory/4280-161-0x000000000040C000-0x000000000040D000-memory.dmp

Filesize
4KB

Download
memory/4280-160-0x000000000040C000-0x000000000040D000-memory.dmp

Filesize
4KB

Download
memory/4280-162-0x000000000040C000-0x000000000040D000-memory.dmp

Filesize
4KB

Download
memory/4280-163-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4280-164-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads