2c5b9875744f2f87bc76410024b5e76bbb75e8fc790b3435a792da16eb107f86 | Triage

Analysis

max time kernel
110s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2023 09:23

Sharing

Report Analysis Logs

General

Target

2d.exe
Size

148KB
MD5

38b50102f941b4f4cba161408cf20933
SHA1

a734a5bd0bf36f205baaa37a4ae84b21eca6b173
SHA256

8b1177549a1f4a0e47acd8ec77bf670ee18efb9f2c18747e460bd8924d5a2024
SHA512

25b513c41662ee4236baae15db95e25ea8defd4483c2d819047e0978253906b355f2f2425f7f4ea6e97994b0a83eb062c772578f24f94c32ad90578b6f2583cd
SSDEEP

3072:BdSg+CABM7yfmgftxDBxdkVWelD8Az9kNP:WgoBJOKxt8VLI

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2088 3096 WerFault.exe 2d.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

2d.exe

pid process

3096 2d.exe

C:\Users\Admin\AppData\Local\Temp\2d.exe
"C:\Users\Admin\AppData\Local\Temp\2d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 464
2⤵
- Program crash
PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3096 -ip 3096
1⤵
PID:4648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...