852445151f40e05c54a017ac6cf93f667dcaba2c3382d3ddd663eb80a2ae2f72 | Triage

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2023, 06:28

Sharing

Report Analysis Logs

General

Target

Inject[Open].exe
Size

27KB
MD5

257c32e8c1d90d50ae779d5dea9b0eba
SHA1

2a3b8b95cfc11c71693942703412048f87cb9973
SHA256

852445151f40e05c54a017ac6cf93f667dcaba2c3382d3ddd663eb80a2ae2f72
SHA512

bd57b51e64a21948af298973b4690f8cf00f800884866ed0a59cee5960c0c7c5913d2d6be0f39332c5784bf541fac1504fcaf0f4dbe0fb43c6cd43084f3cea5b
SSDEEP

768:Y4yoh3ovPMc7QJAHHGTZUPk9ekSmOg+1XBn:YIkMc7QiQeGOnX9

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hackcyber\Soket.mentah	Inject[Open].exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2304	4264	WerFault.exe	79

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4264	Inject[Open].exe
4264	Inject[Open].exe
4264	Inject[Open].exe
4264	Inject[Open].exe

C:\Users\Admin\AppData\Local\Temp\Inject[Open].exe
"C:\Users\Admin\AppData\Local\Temp\Inject[Open].exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 328
  2⤵
  - Program crash
  PID:2304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 4264 -ip 4264
1⤵
PID:2360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads