Analysis
-
max time kernel
189s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
16/01/2023, 13:37
Static task
static1
Behavioral task
behavioral1
Sample
77d29818be0d01c38545baa0bd4551c6853c224b.exe
Resource
win7-20220901-en
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
77d29818be0d01c38545baa0bd4551c6853c224b.exe
Resource
win10v2004-20221111-en
4 signatures
150 seconds
General
-
Target
77d29818be0d01c38545baa0bd4551c6853c224b.exe
-
Size
365KB
-
MD5
343adbd49e24d1bdec30f634f4055da8
-
SHA1
77d29818be0d01c38545baa0bd4551c6853c224b
-
SHA256
404c51dbba49787d8c3d9cde78efc1a5eb0d9f139c0c6b130438870a0ecc244c
-
SHA512
4c6831539aef807c7cb4875306e5fecc06b769924e0a1f80a5316f194a5235ec9e904c932b3ec4021e7ef2237bc2dba3db47a8a1cb20244c67c9fa1e6d88298f
-
SSDEEP
6144:SVjDF2Bp0G3LkjLsvBrL0+ecB4X0Y37cWI+HLq11aWBLXAO1DAjWbc:SRDF2BpjLQLsvBP0+ecyEY37C8P
Score
7/10
Malware Config
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4496 set thread context of 2008 4496 77d29818be0d01c38545baa0bd4551c6853c224b.exe 80 -
Program crash 2 IoCs
pid pid_target Process procid_target 1756 4496 WerFault.exe 77 1664 2008 WerFault.exe 80 -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4496 wrote to memory of 2008 4496 77d29818be0d01c38545baa0bd4551c6853c224b.exe 80 PID 4496 wrote to memory of 2008 4496 77d29818be0d01c38545baa0bd4551c6853c224b.exe 80 PID 4496 wrote to memory of 2008 4496 77d29818be0d01c38545baa0bd4551c6853c224b.exe 80 PID 4496 wrote to memory of 2008 4496 77d29818be0d01c38545baa0bd4551c6853c224b.exe 80 PID 4496 wrote to memory of 2008 4496 77d29818be0d01c38545baa0bd4551c6853c224b.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\77d29818be0d01c38545baa0bd4551c6853c224b.exe"C:\Users\Admin\AppData\Local\Temp\77d29818be0d01c38545baa0bd4551c6853c224b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:2008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 123⤵
- Program crash
PID:1664
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 3002⤵
- Program crash
PID:1756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2008 -ip 20081⤵PID:2484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4496 -ip 44961⤵PID:3424