82d8c107a3489fc8f149fde6469c51309a14fcd816d33d0a709af4b5ffc44ed4

Analysis

max time kernel
143s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
12/12/2022, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3142b9d2704771ae6a3273ef5967fc3e.exe
Size 1.1MB
Sample221212-vb858aef5v
SHA256 82d8c107a3489fc8f149fde6469c51309a14fcd816d33d0a709af4b5ffc44ed4
MD5 3142b9d2704771ae6a3273ef5967fc3e
SHA1 a6155a8f1dc3963aaf8957faf2524b9f32a298d3
SHA512 c64c93dafe2ab8acae689a18a91c742d8a8e090af9b563a02a17922166f0c28b1eea8f4dd2f4f5e208d22c9b64a9530da2131cfc792af0a9db0747939dcf1c11
SSDEEP 24576:VzYK47Z4/f1BNW5gQ7HA44JHrOZTyBd1Dz6Na:lToqXHACQbA44pO81Dz6
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
14	4224	rundll32.exe
15	4224	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
4224	rundll32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2816	1828	WerFault.exe	83
2544	4224	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 4224	1828	3142b9d2704771ae6a3273ef5967fc3e.exe	84
PID 1828 wrote to memory of 4224	1828	3142b9d2704771ae6a3273ef5967fc3e.exe	84
PID 1828 wrote to memory of 4224	1828	3142b9d2704771ae6a3273ef5967fc3e.exe	84

C:\Users\Admin\AppData\Local\Temp\3142b9d2704771ae6a3273ef5967fc3e.exe
"C:\Users\Admin\AppData\Local\Temp\3142b9d2704771ae6a3273ef5967fc3e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Uyieweaiht.tmp",Hfesyte
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:4224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4224 -s 1164
    3⤵
    - Program crash
    PID:2544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 536
  2⤵
  - Program crash
  PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1828 -ip 1828
1⤵
PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4224 -ip 4224
1⤵
PID:3380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Uyieweaiht.tmp

Path C:\Users\Admin\AppData\Local\Temp\Uyieweaiht.tmp
Size 788KB
SHA256 f61cae9301f5336f9048c1b7e68eab13bb839f63925bc6625f8e7e20f32f00c6
MD5 8e37ae196e2cdea4dbc44dc99a84a80f
SHA1 b81e6a81a6efe6f44a0edd73ef3b8635b8ae3a0e
SHA512 fbb1418cab570e6e4e375da3dd99616add73576da1ace88a44adc57a39a6911dab2e3e150366cc7b662604859e6ede53b2a9f2876afe14a0b5e0ea7b7db75e41
SSDEEP 24576:ac1q9q5Jq09sNt1/EGZd/I3rcMcbFhkCobWxIB7N:loqTq0uOGw3kLbI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uyieweaiht.tmp

Path C:\Users\Admin\AppData\Local\Temp\Uyieweaiht.tmp
Size 788KB
SHA256 f61cae9301f5336f9048c1b7e68eab13bb839f63925bc6625f8e7e20f32f00c6
MD5 8e37ae196e2cdea4dbc44dc99a84a80f
SHA1 b81e6a81a6efe6f44a0edd73ef3b8635b8ae3a0e
SHA512 fbb1418cab570e6e4e375da3dd99616add73576da1ace88a44adc57a39a6911dab2e3e150366cc7b662604859e6ede53b2a9f2876afe14a0b5e0ea7b7db75e41
SSDEEP 24576:ac1q9q5Jq09sNt1/EGZd/I3rcMcbFhkCobWxIB7N:loqTq0uOGw3kLbI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1828-132-0x000000000080F000-0x00000000008F7000-memory.dmp

Download

memory/1828-133-0x0000000002340000-0x0000000002469000-memory.dmp

Download

memory/1828-134-0x0000000000400000-0x0000000000532000-memory.dmp

Download

memory/1828-138-0x0000000000400000-0x0000000000532000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads